1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Copyright (C) 2008 IBM Corporation 4 * Author: Mimi Zohar <[email protected]> 5 */ 6 7 #ifndef _LINUX_IMA_H 8 #define _LINUX_IMA_H 9 10 #include <linux/kernel_read_file.h> 11 #include <linux/fs.h> 12 #include <linux/security.h> 13 #include <linux/kexec.h> 14 #include <crypto/hash_info.h> 15 struct linux_binprm; 16 17 #ifdef CONFIG_IMA 18 extern enum hash_algo ima_get_current_hash_algo(void); 19 extern int ima_bprm_check(struct linux_binprm *bprm); 20 extern int ima_file_check(struct file *file, int mask); 21 extern void ima_post_create_tmpfile(struct user_namespace *mnt_userns, 22 struct inode *inode); 23 extern void ima_file_free(struct file *file); 24 extern int ima_file_mmap(struct file *file, unsigned long prot); 25 extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); 26 extern int ima_load_data(enum kernel_load_data_id id, bool contents); 27 extern int ima_post_load_data(char *buf, loff_t size, 28 enum kernel_load_data_id id, char *description); 29 extern int ima_read_file(struct file *file, enum kernel_read_file_id id, 30 bool contents); 31 extern int ima_post_read_file(struct file *file, void *buf, loff_t size, 32 enum kernel_read_file_id id); 33 extern void ima_post_path_mknod(struct user_namespace *mnt_userns, 34 struct dentry *dentry); 35 extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); 36 extern int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size); 37 extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); 38 extern void ima_measure_critical_data(const char *event_label, 39 const char *event_name, 40 const void *buf, size_t buf_len, 41 bool hash); 42 43 #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM 44 extern void ima_appraise_parse_cmdline(void); 45 #else 46 static inline void ima_appraise_parse_cmdline(void) {} 47 #endif 48 49 #ifdef CONFIG_IMA_KEXEC 50 extern void ima_add_kexec_buffer(struct kimage *image); 51 #endif 52 53 #ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT 54 extern bool arch_ima_get_secureboot(void); 55 extern const char * const *arch_get_ima_policy(void); 56 #else 57 static inline bool arch_ima_get_secureboot(void) 58 { 59 return false; 60 } 61 62 static inline const char * const *arch_get_ima_policy(void) 63 { 64 return NULL; 65 } 66 #endif 67 68 #else 69 static inline enum hash_algo ima_get_current_hash_algo(void) 70 { 71 return HASH_ALGO__LAST; 72 } 73 74 static inline int ima_bprm_check(struct linux_binprm *bprm) 75 { 76 return 0; 77 } 78 79 static inline int ima_file_check(struct file *file, int mask) 80 { 81 return 0; 82 } 83 84 static inline void ima_post_create_tmpfile(struct user_namespace *mnt_userns, 85 struct inode *inode) 86 { 87 } 88 89 static inline void ima_file_free(struct file *file) 90 { 91 return; 92 } 93 94 static inline int ima_file_mmap(struct file *file, unsigned long prot) 95 { 96 return 0; 97 } 98 99 static inline int ima_file_mprotect(struct vm_area_struct *vma, 100 unsigned long prot) 101 { 102 return 0; 103 } 104 105 static inline int ima_load_data(enum kernel_load_data_id id, bool contents) 106 { 107 return 0; 108 } 109 110 static inline int ima_post_load_data(char *buf, loff_t size, 111 enum kernel_load_data_id id, 112 char *description) 113 { 114 return 0; 115 } 116 117 static inline int ima_read_file(struct file *file, enum kernel_read_file_id id, 118 bool contents) 119 { 120 return 0; 121 } 122 123 static inline int ima_post_read_file(struct file *file, void *buf, loff_t size, 124 enum kernel_read_file_id id) 125 { 126 return 0; 127 } 128 129 static inline void ima_post_path_mknod(struct user_namespace *mnt_userns, 130 struct dentry *dentry) 131 { 132 return; 133 } 134 135 static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) 136 { 137 return -EOPNOTSUPP; 138 } 139 140 static inline int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size) 141 { 142 return -EOPNOTSUPP; 143 } 144 145 static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} 146 147 static inline void ima_measure_critical_data(const char *event_label, 148 const char *event_name, 149 const void *buf, size_t buf_len, 150 bool hash) {} 151 152 #endif /* CONFIG_IMA */ 153 154 #ifndef CONFIG_IMA_KEXEC 155 struct kimage; 156 157 static inline void ima_add_kexec_buffer(struct kimage *image) 158 {} 159 #endif 160 161 #ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS 162 extern void ima_post_key_create_or_update(struct key *keyring, 163 struct key *key, 164 const void *payload, size_t plen, 165 unsigned long flags, bool create); 166 #else 167 static inline void ima_post_key_create_or_update(struct key *keyring, 168 struct key *key, 169 const void *payload, 170 size_t plen, 171 unsigned long flags, 172 bool create) {} 173 #endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */ 174 175 #ifdef CONFIG_IMA_APPRAISE 176 extern bool is_ima_appraise_enabled(void); 177 extern void ima_inode_post_setattr(struct user_namespace *mnt_userns, 178 struct dentry *dentry); 179 extern int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, 180 const void *xattr_value, size_t xattr_value_len); 181 extern int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name); 182 #else 183 static inline bool is_ima_appraise_enabled(void) 184 { 185 return 0; 186 } 187 188 static inline void ima_inode_post_setattr(struct user_namespace *mnt_userns, 189 struct dentry *dentry) 190 { 191 return; 192 } 193 194 static inline int ima_inode_setxattr(struct dentry *dentry, 195 const char *xattr_name, 196 const void *xattr_value, 197 size_t xattr_value_len) 198 { 199 return 0; 200 } 201 202 static inline int ima_inode_removexattr(struct dentry *dentry, 203 const char *xattr_name) 204 { 205 return 0; 206 } 207 #endif /* CONFIG_IMA_APPRAISE */ 208 209 #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING) 210 extern bool ima_appraise_signature(enum kernel_read_file_id func); 211 #else 212 static inline bool ima_appraise_signature(enum kernel_read_file_id func) 213 { 214 return false; 215 } 216 #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */ 217 #endif /* _LINUX_IMA_H */ 218