security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/list.h>
  15 #include <linux/fs.h>
  16 #include <linux/security.h>
  17 #include <linux/magic.h>
  18 #include <linux/parser.h>
  19 #include <linux/slab.h>
  20 #include <linux/rculist.h>
  21 #include <linux/genhd.h>
  22 #include <linux/seq_file.h>
  23
  24 #include "ima.h"
  25
  26 /* flags definitions */
  27 #define IMA_FUNC        0x0001
  28 #define IMA_MASK        0x0002
  29 #define IMA_FSMAGIC     0x0004
  30 #define IMA_UID         0x0008
  31 #define IMA_FOWNER      0x0010
  32 #define IMA_FSUUID      0x0020
  33 #define IMA_INMASK      0x0040
  34 #define IMA_EUID        0x0080
  35 #define IMA_PCR         0x0100
  36 #define IMA_FSNAME      0x0200
  37
  38 #define UNKNOWN         0
  39 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  40 #define DONT_MEASURE    0x0002
  41 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  42 #define DONT_APPRAISE   0x0008
  43 #define AUDIT           0x0040
  44 #define HASH            0x0100
  45 #define DONT_HASH       0x0200
  46
  47 #define INVALID_PCR(a) (((a) < 0) || \
  48         (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
  49
  50 int ima_policy_flag;
  51 static int temp_ima_appraise;
  52 static int build_ima_appraise __ro_after_init;
  53
  54 #define MAX_LSM_RULES 6
  55 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  56         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  57 };
  58
  59 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  60
  61 struct ima_rule_entry {
  62         struct list_head list;
  63         int action;
  64         unsigned int flags;
  65         enum ima_hooks func;
  66         int mask;
  67         unsigned long fsmagic;
  68         uuid_t fsuuid;
  69         kuid_t uid;
  70         kuid_t fowner;
  71         bool (*uid_op)(kuid_t, kuid_t);    /* Handlers for operators       */
  72         bool (*fowner_op)(kuid_t, kuid_t); /* uid_eq(), uid_gt(), uid_lt() */
  73         int pcr;
  74         struct {
  75                 void *rule;     /* LSM file metadata specific */
  76                 void *args_p;   /* audit value */
  77                 int type;       /* audit type */
  78         } lsm[MAX_LSM_RULES];
  79         char *fsname;
  80 };
  81
  82 /*
  83  * Without LSM specific knowledge, the default policy can only be
  84  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  85  */
  86
  87 /*
  88  * The minimum rule set to allow for full TCB coverage.  Measures all files
  89  * opened or mmap for exec and everything read by root.  Dangerous because
  90  * normal users can easily run the machine out of memory simply building
  91  * and running executables.
  92  */
  93 static struct ima_rule_entry dont_measure_rules[] __ro_after_init = {
  94         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  95         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  96         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  97         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  98         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  99         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 100         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 101         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 102         {.action = DONT_MEASURE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
 103         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
 104          .flags = IMA_FSMAGIC},
 105         {.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC,
 106          .flags = IMA_FSMAGIC},
 107         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
 108 };
 109
 110 static struct ima_rule_entry original_measurement_rules[] __ro_after_init = {
 111         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 112          .flags = IMA_FUNC | IMA_MASK},
 113         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 114          .flags = IMA_FUNC | IMA_MASK},
 115         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 116          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 117          .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 118         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 119         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 120 };
 121
 122 static struct ima_rule_entry default_measurement_rules[] __ro_after_init = {
 123         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 124          .flags = IMA_FUNC | IMA_MASK},
 125         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 126          .flags = IMA_FUNC | IMA_MASK},
 127         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 128          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 129          .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 130         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 131          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 132          .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 133         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 134         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 135         {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
 136 };
 137
 138 static struct ima_rule_entry default_appraise_rules[] __ro_after_init = {
 139         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 140         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 141         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 142         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 143         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 144         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 145         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 146         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 147         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 148         {.action = DONT_APPRAISE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
 149         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 150         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 151         {.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 152 #ifdef CONFIG_IMA_WRITE_POLICY
 153         {.action = APPRAISE, .func = POLICY_CHECK,
 154         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 155 #endif
 156 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 157         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 158          .flags = IMA_FOWNER},
 159 #else
 160         /* force signature */
 161         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 162          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 163 #endif
 164 };
 165
 166 static struct ima_rule_entry build_appraise_rules[] __ro_after_init = {
 167 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS
 168         {.action = APPRAISE, .func = MODULE_CHECK,
 169          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 170 #endif
 171 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS
 172         {.action = APPRAISE, .func = FIRMWARE_CHECK,
 173          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 174 #endif
 175 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS
 176         {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
 177          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 178 #endif
 179 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS
 180         {.action = APPRAISE, .func = POLICY_CHECK,
 181          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 182 #endif
 183 };
 184
 185 static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
 186         {.action = APPRAISE, .func = MODULE_CHECK,
 187          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 188         {.action = APPRAISE, .func = FIRMWARE_CHECK,
 189          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 190         {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
 191          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 192         {.action = APPRAISE, .func = POLICY_CHECK,
 193          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 194 };
 195
 196 static LIST_HEAD(ima_default_rules);
 197 static LIST_HEAD(ima_policy_rules);
 198 static LIST_HEAD(ima_temp_rules);
 199 static struct list_head *ima_rules = &ima_default_rules;
 200
 201 static int ima_policy __initdata;
 202
 203 static int __init default_measure_policy_setup(char *str)
 204 {
 205         if (ima_policy)
 206                 return 1;
 207
 208         ima_policy = ORIGINAL_TCB;
 209         return 1;
 210 }
 211 __setup("ima_tcb", default_measure_policy_setup);
 212
 213 static bool ima_use_appraise_tcb __initdata;
 214 static bool ima_use_secure_boot __initdata;
 215 static bool ima_fail_unverifiable_sigs __ro_after_init;
 216 static int __init policy_setup(char *str)
 217 {
 218         char *p;
 219
 220         while ((p = strsep(&str, " |\n")) != NULL) {
 221                 if (*p == ' ')
 222                         continue;
 223                 if ((strcmp(p, "tcb") == 0) && !ima_policy)
 224                         ima_policy = DEFAULT_TCB;
 225                 else if (strcmp(p, "appraise_tcb") == 0)
 226                         ima_use_appraise_tcb = true;
 227                 else if (strcmp(p, "secure_boot") == 0)
 228                         ima_use_secure_boot = true;
 229                 else if (strcmp(p, "fail_securely") == 0)
 230                         ima_fail_unverifiable_sigs = true;
 231         }
 232
 233         return 1;
 234 }
 235 __setup("ima_policy=", policy_setup);
 236
 237 static int __init default_appraise_policy_setup(char *str)
 238 {
 239         ima_use_appraise_tcb = true;
 240         return 1;
 241 }
 242 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 243
 244 static void ima_free_rule(struct ima_rule_entry *entry)
 245 {
 246         int i;
 247
 248         if (!entry)
 249                 return;
 250
 251         kfree(entry->fsname);
 252         for (i = 0; i < MAX_LSM_RULES; i++) {
 253                 security_filter_rule_free(entry->lsm[i].rule);
 254                 kfree(entry->lsm[i].args_p);
 255         }
 256         kfree(entry);
 257 }
 258
 259 /*
 260  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 261  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 262  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 263  * they don't.
 264  */
 265 static void ima_lsm_update_rules(void)
 266 {
 267         struct ima_rule_entry *entry;
 268         int result;
 269         int i;
 270
 271         list_for_each_entry(entry, &ima_policy_rules, list) {
 272                 for (i = 0; i < MAX_LSM_RULES; i++) {
 273                         if (!entry->lsm[i].rule)
 274                                 continue;
 275                         result = security_filter_rule_init(entry->lsm[i].type,
 276                                                            Audit_equal,
 277                                                            entry->lsm[i].args_p,
 278                                                            &entry->lsm[i].rule);
 279                         BUG_ON(!entry->lsm[i].rule);
 280                 }
 281         }
 282 }
 283
 284 /**
 285  * ima_match_rules - determine whether an inode matches the measure rule.
 286  * @rule: a pointer to a rule
 287  * @inode: a pointer to an inode
 288  * @cred: a pointer to a credentials structure for user validation
 289  * @secid: the secid of the task to be validated
 290  * @func: LIM hook identifier
 291  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 292  *
 293  * Returns true on rule match, false on failure.
 294  */
 295 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 296                             const struct cred *cred, u32 secid,
 297                             enum ima_hooks func, int mask)
 298 {
 299         int i;
 300
 301         if ((rule->flags & IMA_FUNC) &&
 302             (rule->func != func && func != POST_SETATTR))
 303                 return false;
 304         if ((rule->flags & IMA_MASK) &&
 305             (rule->mask != mask && func != POST_SETATTR))
 306                 return false;
 307         if ((rule->flags & IMA_INMASK) &&
 308             (!(rule->mask & mask) && func != POST_SETATTR))
 309                 return false;
 310         if ((rule->flags & IMA_FSMAGIC)
 311             && rule->fsmagic != inode->i_sb->s_magic)
 312                 return false;
 313         if ((rule->flags & IMA_FSNAME)
 314             && strcmp(rule->fsname, inode->i_sb->s_type->name))
 315                 return false;
 316         if ((rule->flags & IMA_FSUUID) &&
 317             !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid))
 318                 return false;
 319         if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
 320                 return false;
 321         if (rule->flags & IMA_EUID) {
 322                 if (has_capability_noaudit(current, CAP_SETUID)) {
 323                         if (!rule->uid_op(cred->euid, rule->uid)
 324                             && !rule->uid_op(cred->suid, rule->uid)
 325                             && !rule->uid_op(cred->uid, rule->uid))
 326                                 return false;
 327                 } else if (!rule->uid_op(cred->euid, rule->uid))
 328                         return false;
 329         }
 330
 331         if ((rule->flags & IMA_FOWNER) &&
 332             !rule->fowner_op(inode->i_uid, rule->fowner))
 333                 return false;
 334         for (i = 0; i < MAX_LSM_RULES; i++) {
 335                 int rc = 0;
 336                 u32 osid;
 337                 int retried = 0;
 338
 339                 if (!rule->lsm[i].rule)
 340                         continue;
 341 retry:
 342                 switch (i) {
 343                 case LSM_OBJ_USER:
 344                 case LSM_OBJ_ROLE:
 345                 case LSM_OBJ_TYPE:
 346                         security_inode_getsecid(inode, &osid);
 347                         rc = security_filter_rule_match(osid,
 348                                                         rule->lsm[i].type,
 349                                                         Audit_equal,
 350                                                         rule->lsm[i].rule,
 351                                                         NULL);
 352                         break;
 353                 case LSM_SUBJ_USER:
 354                 case LSM_SUBJ_ROLE:
 355                 case LSM_SUBJ_TYPE:
 356                         rc = security_filter_rule_match(secid,
 357                                                         rule->lsm[i].type,
 358                                                         Audit_equal,
 359                                                         rule->lsm[i].rule,
 360                                                         NULL);
 361                 default:
 362                         break;
 363                 }
 364                 if ((rc < 0) && (!retried)) {
 365                         retried = 1;
 366                         ima_lsm_update_rules();
 367                         goto retry;
 368                 }
 369                 if (!rc)
 370                         return false;
 371         }
 372         return true;
 373 }
 374
 375 /*
 376  * In addition to knowing that we need to appraise the file in general,
 377  * we need to differentiate between calling hooks, for hook specific rules.
 378  */
 379 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 380 {
 381         if (!(rule->flags & IMA_FUNC))
 382                 return IMA_FILE_APPRAISE;
 383
 384         switch (func) {
 385         case MMAP_CHECK:
 386                 return IMA_MMAP_APPRAISE;
 387         case BPRM_CHECK:
 388                 return IMA_BPRM_APPRAISE;
 389         case CREDS_CHECK:
 390                 return IMA_CREDS_APPRAISE;
 391         case FILE_CHECK:
 392         case POST_SETATTR:
 393                 return IMA_FILE_APPRAISE;
 394         case MODULE_CHECK ... MAX_CHECK - 1:
 395         default:
 396                 return IMA_READ_APPRAISE;
 397         }
 398 }
 399
 400 /**
 401  * ima_match_policy - decision based on LSM and other conditions
 402  * @inode: pointer to an inode for which the policy decision is being made
 403  * @cred: pointer to a credentials structure for which the policy decision is
 404  *        being made
 405  * @secid: LSM secid of the task to be validated
 406  * @func: IMA hook identifier
 407  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 408  * @pcr: set the pcr to extend
 409  *
 410  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 411  * conditions.
 412  *
 413  * Since the IMA policy may be updated multiple times we need to lock the
 414  * list when walking it.  Reads are many orders of magnitude more numerous
 415  * than writes so ima_match_policy() is classical RCU candidate.
 416  */
 417 int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
 418                      enum ima_hooks func, int mask, int flags, int *pcr)
 419 {
 420         struct ima_rule_entry *entry;
 421         int action = 0, actmask = flags | (flags << 1);
 422
 423         rcu_read_lock();
 424         list_for_each_entry_rcu(entry, ima_rules, list) {
 425
 426                 if (!(entry->action & actmask))
 427                         continue;
 428
 429                 if (!ima_match_rules(entry, inode, cred, secid, func, mask))
 430                         continue;
 431
 432                 action |= entry->flags & IMA_ACTION_FLAGS;
 433
 434                 action |= entry->action & IMA_DO_MASK;
 435                 if (entry->action & IMA_APPRAISE) {
 436                         action |= get_subaction(entry, func);
 437                         action &= ~IMA_HASH;
 438                         if (ima_fail_unverifiable_sigs)
 439                                 action |= IMA_FAIL_UNVERIFIABLE_SIGS;
 440                 }
 441
 442                 if (entry->action & IMA_DO_MASK)
 443                         actmask &= ~(entry->action | entry->action << 1);
 444                 else
 445                         actmask &= ~(entry->action | entry->action >> 1);
 446
 447                 if ((pcr) && (entry->flags & IMA_PCR))
 448                         *pcr = entry->pcr;
 449
 450                 if (!actmask)
 451                         break;
 452         }
 453         rcu_read_unlock();
 454
 455         return action;
 456 }
 457
 458 /*
 459  * Initialize the ima_policy_flag variable based on the currently
 460  * loaded policy.  Based on this flag, the decision to short circuit
 461  * out of a function or not call the function in the first place
 462  * can be made earlier.
 463  */
 464 void ima_update_policy_flag(void)
 465 {
 466         struct ima_rule_entry *entry;
 467
 468         list_for_each_entry(entry, ima_rules, list) {
 469                 if (entry->action & IMA_DO_MASK)
 470                         ima_policy_flag |= entry->action;
 471         }
 472
 473         ima_appraise |= (build_ima_appraise | temp_ima_appraise);
 474         if (!ima_appraise)
 475                 ima_policy_flag &= ~IMA_APPRAISE;
 476 }
 477
 478 static int ima_appraise_flag(enum ima_hooks func)
 479 {
 480         if (func == MODULE_CHECK)
 481                 return IMA_APPRAISE_MODULES;
 482         else if (func == FIRMWARE_CHECK)
 483                 return IMA_APPRAISE_FIRMWARE;
 484         else if (func == POLICY_CHECK)
 485                 return IMA_APPRAISE_POLICY;
 486         else if (func == KEXEC_KERNEL_CHECK)
 487                 return IMA_APPRAISE_KEXEC;
 488         return 0;
 489 }
 490
 491 /**
 492  * ima_init_policy - initialize the default measure rules.
 493  *
 494  * ima_rules points to either the ima_default_rules or the
 495  * the new ima_policy_rules.
 496  */
 497 void __init ima_init_policy(void)
 498 {
 499         int i, measure_entries, appraise_entries, secure_boot_entries;
 500
 501         /* if !ima_policy set entries = 0 so we load NO default rules */
 502         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 503         appraise_entries = ima_use_appraise_tcb ?
 504                          ARRAY_SIZE(default_appraise_rules) : 0;
 505         secure_boot_entries = ima_use_secure_boot ?
 506                         ARRAY_SIZE(secure_boot_rules) : 0;
 507
 508         for (i = 0; i < measure_entries; i++)
 509                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 510
 511         switch (ima_policy) {
 512         case ORIGINAL_TCB:
 513                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 514                         list_add_tail(&original_measurement_rules[i].list,
 515                                       &ima_default_rules);
 516                 break;
 517         case DEFAULT_TCB:
 518                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 519                         list_add_tail(&default_measurement_rules[i].list,
 520                                       &ima_default_rules);
 521         default:
 522                 break;
 523         }
 524
 525         /*
 526          * Insert the builtin "secure_boot" policy rules requiring file
 527          * signatures, prior to any other appraise rules.
 528          */
 529         for (i = 0; i < secure_boot_entries; i++) {
 530                 list_add_tail(&secure_boot_rules[i].list, &ima_default_rules);
 531                 temp_ima_appraise |=
 532                     ima_appraise_flag(secure_boot_rules[i].func);
 533         }
 534
 535         /*
 536          * Insert the build time appraise rules requiring file signatures
 537          * for both the initial and custom policies, prior to other appraise
 538          * rules.
 539          */
 540         for (i = 0; i < ARRAY_SIZE(build_appraise_rules); i++) {
 541                 struct ima_rule_entry *entry;
 542
 543                 if (!secure_boot_entries)
 544                         list_add_tail(&build_appraise_rules[i].list,
 545                                       &ima_default_rules);
 546
 547                 entry = kmemdup(&build_appraise_rules[i], sizeof(*entry),
 548                                 GFP_KERNEL);
 549                 if (entry)
 550                         list_add_tail(&entry->list, &ima_policy_rules);
 551                 build_ima_appraise |=
 552                         ima_appraise_flag(build_appraise_rules[i].func);
 553         }
 554
 555         for (i = 0; i < appraise_entries; i++) {
 556                 list_add_tail(&default_appraise_rules[i].list,
 557                               &ima_default_rules);
 558                 if (default_appraise_rules[i].func == POLICY_CHECK)
 559                         temp_ima_appraise |= IMA_APPRAISE_POLICY;
 560         }
 561
 562         ima_update_policy_flag();
 563 }
 564
 565 /* Make sure we have a valid policy, at least containing some rules. */
 566 int ima_check_policy(void)
 567 {
 568         if (list_empty(&ima_temp_rules))
 569                 return -EINVAL;
 570         return 0;
 571 }
 572
 573 /**
 574  * ima_update_policy - update default_rules with new measure rules
 575  *
 576  * Called on file .release to update the default rules with a complete new
 577  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 578  * they make a queue.  The policy may be updated multiple times and this is the
 579  * RCU updater.
 580  *
 581  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 582  * we switch from the default policy to user defined.
 583  */
 584 void ima_update_policy(void)
 585 {
 586         struct list_head *policy = &ima_policy_rules;
 587
 588         list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu);
 589
 590         if (ima_rules != policy) {
 591                 ima_policy_flag = 0;
 592                 ima_rules = policy;
 593         }
 594         ima_update_policy_flag();
 595 }
 596
 597 enum {
 598         Opt_err = -1,
 599         Opt_measure = 1, Opt_dont_measure,
 600         Opt_appraise, Opt_dont_appraise,
 601         Opt_audit, Opt_hash, Opt_dont_hash,
 602         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 603         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 604         Opt_func, Opt_mask, Opt_fsmagic, Opt_fsname,
 605         Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq,
 606         Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt,
 607         Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt,
 608         Opt_appraise_type, Opt_permit_directio,
 609         Opt_pcr
 610 };
 611
 612 static match_table_t policy_tokens = {
 613         {Opt_measure, "measure"},
 614         {Opt_dont_measure, "dont_measure"},
 615         {Opt_appraise, "appraise"},
 616         {Opt_dont_appraise, "dont_appraise"},
 617         {Opt_audit, "audit"},
 618         {Opt_hash, "hash"},
 619         {Opt_dont_hash, "dont_hash"},
 620         {Opt_obj_user, "obj_user=%s"},
 621         {Opt_obj_role, "obj_role=%s"},
 622         {Opt_obj_type, "obj_type=%s"},
 623         {Opt_subj_user, "subj_user=%s"},
 624         {Opt_subj_role, "subj_role=%s"},
 625         {Opt_subj_type, "subj_type=%s"},
 626         {Opt_func, "func=%s"},
 627         {Opt_mask, "mask=%s"},
 628         {Opt_fsmagic, "fsmagic=%s"},
 629         {Opt_fsname, "fsname=%s"},
 630         {Opt_fsuuid, "fsuuid=%s"},
 631         {Opt_uid_eq, "uid=%s"},
 632         {Opt_euid_eq, "euid=%s"},
 633         {Opt_fowner_eq, "fowner=%s"},
 634         {Opt_uid_gt, "uid>%s"},
 635         {Opt_euid_gt, "euid>%s"},
 636         {Opt_fowner_gt, "fowner>%s"},
 637         {Opt_uid_lt, "uid<%s"},
 638         {Opt_euid_lt, "euid<%s"},
 639         {Opt_fowner_lt, "fowner<%s"},
 640         {Opt_appraise_type, "appraise_type=%s"},
 641         {Opt_permit_directio, "permit_directio"},
 642         {Opt_pcr, "pcr=%s"},
 643         {Opt_err, NULL}
 644 };
 645
 646 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 647                              substring_t *args, int lsm_rule, int audit_type)
 648 {
 649         int result;
 650
 651         if (entry->lsm[lsm_rule].rule)
 652                 return -EINVAL;
 653
 654         entry->lsm[lsm_rule].args_p = match_strdup(args);
 655         if (!entry->lsm[lsm_rule].args_p)
 656                 return -ENOMEM;
 657
 658         entry->lsm[lsm_rule].type = audit_type;
 659         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 660                                            Audit_equal,
 661                                            entry->lsm[lsm_rule].args_p,
 662                                            &entry->lsm[lsm_rule].rule);
 663         if (!entry->lsm[lsm_rule].rule) {
 664                 kfree(entry->lsm[lsm_rule].args_p);
 665                 entry->lsm[lsm_rule].args_p = NULL;
 666                 return -EINVAL;
 667         }
 668
 669         return result;
 670 }
 671
 672 static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value,
 673                               bool (*rule_operator)(kuid_t, kuid_t))
 674 {
 675         if (!ab)
 676                 return;
 677
 678         if (rule_operator == &uid_gt)
 679                 audit_log_format(ab, "%s>", key);
 680         else if (rule_operator == &uid_lt)
 681                 audit_log_format(ab, "%s<", key);
 682         else
 683                 audit_log_format(ab, "%s=", key);
 684         audit_log_format(ab, "%s ", value);
 685 }
 686 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 687 {
 688         ima_log_string_op(ab, key, value, NULL);
 689 }
 690
 691 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 692 {
 693         struct audit_buffer *ab;
 694         char *from;
 695         char *p;
 696         bool uid_token;
 697         int result = 0;
 698
 699         ab = integrity_audit_log_start(audit_context(), GFP_KERNEL,
 700                                        AUDIT_INTEGRITY_POLICY_RULE);
 701
 702         entry->uid = INVALID_UID;
 703         entry->fowner = INVALID_UID;
 704         entry->uid_op = &uid_eq;
 705         entry->fowner_op = &uid_eq;
 706         entry->action = UNKNOWN;
 707         while ((p = strsep(&rule, " \t")) != NULL) {
 708                 substring_t args[MAX_OPT_ARGS];
 709                 int token;
 710                 unsigned long lnum;
 711
 712                 if (result < 0)
 713                         break;
 714                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 715                         continue;
 716                 token = match_token(p, policy_tokens, args);
 717                 switch (token) {
 718                 case Opt_measure:
 719                         ima_log_string(ab, "action", "measure");
 720
 721                         if (entry->action != UNKNOWN)
 722                                 result = -EINVAL;
 723
 724                         entry->action = MEASURE;
 725                         break;
 726                 case Opt_dont_measure:
 727                         ima_log_string(ab, "action", "dont_measure");
 728
 729                         if (entry->action != UNKNOWN)
 730                                 result = -EINVAL;
 731
 732                         entry->action = DONT_MEASURE;
 733                         break;
 734                 case Opt_appraise:
 735                         ima_log_string(ab, "action", "appraise");
 736
 737                         if (entry->action != UNKNOWN)
 738                                 result = -EINVAL;
 739
 740                         entry->action = APPRAISE;
 741                         break;
 742                 case Opt_dont_appraise:
 743                         ima_log_string(ab, "action", "dont_appraise");
 744
 745                         if (entry->action != UNKNOWN)
 746                                 result = -EINVAL;
 747
 748                         entry->action = DONT_APPRAISE;
 749                         break;
 750                 case Opt_audit:
 751                         ima_log_string(ab, "action", "audit");
 752
 753                         if (entry->action != UNKNOWN)
 754                                 result = -EINVAL;
 755
 756                         entry->action = AUDIT;
 757                         break;
 758                 case Opt_hash:
 759                         ima_log_string(ab, "action", "hash");
 760
 761                         if (entry->action != UNKNOWN)
 762                                 result = -EINVAL;
 763
 764                         entry->action = HASH;
 765                         break;
 766                 case Opt_dont_hash:
 767                         ima_log_string(ab, "action", "dont_hash");
 768
 769                         if (entry->action != UNKNOWN)
 770                                 result = -EINVAL;
 771
 772                         entry->action = DONT_HASH;
 773                         break;
 774                 case Opt_func:
 775                         ima_log_string(ab, "func", args[0].from);
 776
 777                         if (entry->func)
 778                                 result = -EINVAL;
 779
 780                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 781                                 entry->func = FILE_CHECK;
 782                         /* PATH_CHECK is for backwards compat */
 783                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 784                                 entry->func = FILE_CHECK;
 785                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 786                                 entry->func = MODULE_CHECK;
 787                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 788                                 entry->func = FIRMWARE_CHECK;
 789                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 790                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 791                                 entry->func = MMAP_CHECK;
 792                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 793                                 entry->func = BPRM_CHECK;
 794                         else if (strcmp(args[0].from, "CREDS_CHECK") == 0)
 795                                 entry->func = CREDS_CHECK;
 796                         else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
 797                                  0)
 798                                 entry->func = KEXEC_KERNEL_CHECK;
 799                         else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
 800                                  == 0)
 801                                 entry->func = KEXEC_INITRAMFS_CHECK;
 802                         else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
 803                                 entry->func = POLICY_CHECK;
 804                         else
 805                                 result = -EINVAL;
 806                         if (!result)
 807                                 entry->flags |= IMA_FUNC;
 808                         break;
 809                 case Opt_mask:
 810                         ima_log_string(ab, "mask", args[0].from);
 811
 812                         if (entry->mask)
 813                                 result = -EINVAL;
 814
 815                         from = args[0].from;
 816                         if (*from == '^')
 817                                 from++;
 818
 819                         if ((strcmp(from, "MAY_EXEC")) == 0)
 820                                 entry->mask = MAY_EXEC;
 821                         else if (strcmp(from, "MAY_WRITE") == 0)
 822                                 entry->mask = MAY_WRITE;
 823                         else if (strcmp(from, "MAY_READ") == 0)
 824                                 entry->mask = MAY_READ;
 825                         else if (strcmp(from, "MAY_APPEND") == 0)
 826                                 entry->mask = MAY_APPEND;
 827                         else
 828                                 result = -EINVAL;
 829                         if (!result)
 830                                 entry->flags |= (*args[0].from == '^')
 831                                      ? IMA_INMASK : IMA_MASK;
 832                         break;
 833                 case Opt_fsmagic:
 834                         ima_log_string(ab, "fsmagic", args[0].from);
 835
 836                         if (entry->fsmagic) {
 837                                 result = -EINVAL;
 838                                 break;
 839                         }
 840
 841                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 842                         if (!result)
 843                                 entry->flags |= IMA_FSMAGIC;
 844                         break;
 845                 case Opt_fsname:
 846                         ima_log_string(ab, "fsname", args[0].from);
 847
 848                         entry->fsname = kstrdup(args[0].from, GFP_KERNEL);
 849                         if (!entry->fsname) {
 850                                 result = -ENOMEM;
 851                                 break;
 852                         }
 853                         result = 0;
 854                         entry->flags |= IMA_FSNAME;
 855                         break;
 856                 case Opt_fsuuid:
 857                         ima_log_string(ab, "fsuuid", args[0].from);
 858
 859                         if (!uuid_is_null(&entry->fsuuid)) {
 860                                 result = -EINVAL;
 861                                 break;
 862                         }
 863
 864                         result = uuid_parse(args[0].from, &entry->fsuuid);
 865                         if (!result)
 866                                 entry->flags |= IMA_FSUUID;
 867                         break;
 868                 case Opt_uid_gt:
 869                 case Opt_euid_gt:
 870                         entry->uid_op = &uid_gt;
 871                 case Opt_uid_lt:
 872                 case Opt_euid_lt:
 873                         if ((token == Opt_uid_lt) || (token == Opt_euid_lt))
 874                                 entry->uid_op = &uid_lt;
 875                 case Opt_uid_eq:
 876                 case Opt_euid_eq:
 877                         uid_token = (token == Opt_uid_eq) ||
 878                                     (token == Opt_uid_gt) ||
 879                                     (token == Opt_uid_lt);
 880
 881                         ima_log_string_op(ab, uid_token ? "uid" : "euid",
 882                                           args[0].from, entry->uid_op);
 883
 884                         if (uid_valid(entry->uid)) {
 885                                 result = -EINVAL;
 886                                 break;
 887                         }
 888
 889                         result = kstrtoul(args[0].from, 10, &lnum);
 890                         if (!result) {
 891                                 entry->uid = make_kuid(current_user_ns(),
 892                                                        (uid_t) lnum);
 893                                 if (!uid_valid(entry->uid) ||
 894                                     (uid_t)lnum != lnum)
 895                                         result = -EINVAL;
 896                                 else
 897                                         entry->flags |= uid_token
 898                                             ? IMA_UID : IMA_EUID;
 899                         }
 900                         break;
 901                 case Opt_fowner_gt:
 902                         entry->fowner_op = &uid_gt;
 903                 case Opt_fowner_lt:
 904                         if (token == Opt_fowner_lt)
 905                                 entry->fowner_op = &uid_lt;
 906                 case Opt_fowner_eq:
 907                         ima_log_string_op(ab, "fowner", args[0].from,
 908                                           entry->fowner_op);
 909
 910                         if (uid_valid(entry->fowner)) {
 911                                 result = -EINVAL;
 912                                 break;
 913                         }
 914
 915                         result = kstrtoul(args[0].from, 10, &lnum);
 916                         if (!result) {
 917                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 918                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 919                                         result = -EINVAL;
 920                                 else
 921                                         entry->flags |= IMA_FOWNER;
 922                         }
 923                         break;
 924                 case Opt_obj_user:
 925                         ima_log_string(ab, "obj_user", args[0].from);
 926                         result = ima_lsm_rule_init(entry, args,
 927                                                    LSM_OBJ_USER,
 928                                                    AUDIT_OBJ_USER);
 929                         break;
 930                 case Opt_obj_role:
 931                         ima_log_string(ab, "obj_role", args[0].from);
 932                         result = ima_lsm_rule_init(entry, args,
 933                                                    LSM_OBJ_ROLE,
 934                                                    AUDIT_OBJ_ROLE);
 935                         break;
 936                 case Opt_obj_type:
 937                         ima_log_string(ab, "obj_type", args[0].from);
 938                         result = ima_lsm_rule_init(entry, args,
 939                                                    LSM_OBJ_TYPE,
 940                                                    AUDIT_OBJ_TYPE);
 941                         break;
 942                 case Opt_subj_user:
 943                         ima_log_string(ab, "subj_user", args[0].from);
 944                         result = ima_lsm_rule_init(entry, args,
 945                                                    LSM_SUBJ_USER,
 946                                                    AUDIT_SUBJ_USER);
 947                         break;
 948                 case Opt_subj_role:
 949                         ima_log_string(ab, "subj_role", args[0].from);
 950                         result = ima_lsm_rule_init(entry, args,
 951                                                    LSM_SUBJ_ROLE,
 952                                                    AUDIT_SUBJ_ROLE);
 953                         break;
 954                 case Opt_subj_type:
 955                         ima_log_string(ab, "subj_type", args[0].from);
 956                         result = ima_lsm_rule_init(entry, args,
 957                                                    LSM_SUBJ_TYPE,
 958                                                    AUDIT_SUBJ_TYPE);
 959                         break;
 960                 case Opt_appraise_type:
 961                         if (entry->action != APPRAISE) {
 962                                 result = -EINVAL;
 963                                 break;
 964                         }
 965
 966                         ima_log_string(ab, "appraise_type", args[0].from);
 967                         if ((strcmp(args[0].from, "imasig")) == 0)
 968                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 969                         else
 970                                 result = -EINVAL;
 971                         break;
 972                 case Opt_permit_directio:
 973                         entry->flags |= IMA_PERMIT_DIRECTIO;
 974                         break;
 975                 case Opt_pcr:
 976                         if (entry->action != MEASURE) {
 977                                 result = -EINVAL;
 978                                 break;
 979                         }
 980                         ima_log_string(ab, "pcr", args[0].from);
 981
 982                         result = kstrtoint(args[0].from, 10, &entry->pcr);
 983                         if (result || INVALID_PCR(entry->pcr))
 984                                 result = -EINVAL;
 985                         else
 986                                 entry->flags |= IMA_PCR;
 987
 988                         break;
 989                 case Opt_err:
 990                         ima_log_string(ab, "UNKNOWN", p);
 991                         result = -EINVAL;
 992                         break;
 993                 }
 994         }
 995         if (!result && (entry->action == UNKNOWN))
 996                 result = -EINVAL;
 997         else if (entry->action == APPRAISE)
 998                 temp_ima_appraise |= ima_appraise_flag(entry->func);
 999
1000         audit_log_format(ab, "res=%d", !result);
1001         audit_log_end(ab);
1002         return result;
1003 }
1004
1005 /**
1006  * ima_parse_add_rule - add a rule to ima_policy_rules
1007  * @rule - ima measurement policy rule
1008  *
1009  * Avoid locking by allowing just one writer at a time in ima_write_policy()
1010  * Returns the length of the rule parsed, an error code on failure
1011  */
1012 ssize_t ima_parse_add_rule(char *rule)
1013 {
1014         static const char op[] = "update_policy";
1015         char *p;
1016         struct ima_rule_entry *entry;
1017         ssize_t result, len;
1018         int audit_info = 0;
1019
1020         p = strsep(&rule, "\n");
1021         len = strlen(p) + 1;
1022         p += strspn(p, " \t");
1023
1024         if (*p == '#' || *p == '\0')
1025                 return len;
1026
1027         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1028         if (!entry) {
1029                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1030                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
1031                 return -ENOMEM;
1032         }
1033
1034         INIT_LIST_HEAD(&entry->list);
1035
1036         result = ima_parse_rule(p, entry);
1037         if (result) {
1038                 ima_free_rule(entry);
1039                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1040                                     NULL, op, "invalid-policy", result,
1041                                     audit_info);
1042                 return result;
1043         }
1044
1045         list_add_tail(&entry->list, &ima_temp_rules);
1046
1047         return len;
1048 }
1049
1050 /**
1051  * ima_delete_rules() called to cleanup invalid in-flight policy.
1052  * We don't need locking as we operate on the temp list, which is
1053  * different from the active one.  There is also only one user of
1054  * ima_delete_rules() at a time.
1055  */
1056 void ima_delete_rules(void)
1057 {
1058         struct ima_rule_entry *entry, *tmp;
1059
1060         temp_ima_appraise = 0;
1061         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
1062                 list_del(&entry->list);
1063                 ima_free_rule(entry);
1064         }
1065 }
1066
1067 #ifdef  CONFIG_IMA_READ_POLICY
1068 enum {
1069         mask_exec = 0, mask_write, mask_read, mask_append
1070 };
1071
1072 static const char *const mask_tokens[] = {
1073         "^MAY_EXEC",
1074         "^MAY_WRITE",
1075         "^MAY_READ",
1076         "^MAY_APPEND"
1077 };
1078
1079 #define __ima_hook_stringify(str)       (#str),
1080
1081 static const char *const func_tokens[] = {
1082         __ima_hooks(__ima_hook_stringify)
1083 };
1084
1085 void *ima_policy_start(struct seq_file *m, loff_t *pos)
1086 {
1087         loff_t l = *pos;
1088         struct ima_rule_entry *entry;
1089
1090         rcu_read_lock();
1091         list_for_each_entry_rcu(entry, ima_rules, list) {
1092                 if (!l--) {
1093                         rcu_read_unlock();
1094                         return entry;
1095                 }
1096         }
1097         rcu_read_unlock();
1098         return NULL;
1099 }
1100
1101 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
1102 {
1103         struct ima_rule_entry *entry = v;
1104
1105         rcu_read_lock();
1106         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
1107         rcu_read_unlock();
1108         (*pos)++;
1109
1110         return (&entry->list == ima_rules) ? NULL : entry;
1111 }
1112
1113 void ima_policy_stop(struct seq_file *m, void *v)
1114 {
1115 }
1116
1117 #define pt(token)       policy_tokens[token + Opt_err].pattern
1118 #define mt(token)       mask_tokens[token]
1119
1120 /*
1121  * policy_func_show - display the ima_hooks policy rule
1122  */
1123 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
1124 {
1125         if (func > 0 && func < MAX_CHECK)
1126                 seq_printf(m, "func=%s ", func_tokens[func]);
1127         else
1128                 seq_printf(m, "func=%d ", func);
1129 }
1130
1131 int ima_policy_show(struct seq_file *m, void *v)
1132 {
1133         struct ima_rule_entry *entry = v;
1134         int i;
1135         char tbuf[64] = {0,};
1136         int offset = 0;
1137
1138         rcu_read_lock();
1139
1140         if (entry->action & MEASURE)
1141                 seq_puts(m, pt(Opt_measure));
1142         if (entry->action & DONT_MEASURE)
1143                 seq_puts(m, pt(Opt_dont_measure));
1144         if (entry->action & APPRAISE)
1145                 seq_puts(m, pt(Opt_appraise));
1146         if (entry->action & DONT_APPRAISE)
1147                 seq_puts(m, pt(Opt_dont_appraise));
1148         if (entry->action & AUDIT)
1149                 seq_puts(m, pt(Opt_audit));
1150         if (entry->action & HASH)
1151                 seq_puts(m, pt(Opt_hash));
1152         if (entry->action & DONT_HASH)
1153                 seq_puts(m, pt(Opt_dont_hash));
1154
1155         seq_puts(m, " ");
1156
1157         if (entry->flags & IMA_FUNC)
1158                 policy_func_show(m, entry->func);
1159
1160         if ((entry->flags & IMA_MASK) || (entry->flags & IMA_INMASK)) {
1161                 if (entry->flags & IMA_MASK)
1162                         offset = 1;
1163                 if (entry->mask & MAY_EXEC)
1164                         seq_printf(m, pt(Opt_mask), mt(mask_exec) + offset);
1165                 if (entry->mask & MAY_WRITE)
1166                         seq_printf(m, pt(Opt_mask), mt(mask_write) + offset);
1167                 if (entry->mask & MAY_READ)
1168                         seq_printf(m, pt(Opt_mask), mt(mask_read) + offset);
1169                 if (entry->mask & MAY_APPEND)
1170                         seq_printf(m, pt(Opt_mask), mt(mask_append) + offset);
1171                 seq_puts(m, " ");
1172         }
1173
1174         if (entry->flags & IMA_FSMAGIC) {
1175                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1176                 seq_printf(m, pt(Opt_fsmagic), tbuf);
1177                 seq_puts(m, " ");
1178         }
1179
1180         if (entry->flags & IMA_FSNAME) {
1181                 snprintf(tbuf, sizeof(tbuf), "%s", entry->fsname);
1182                 seq_printf(m, pt(Opt_fsname), tbuf);
1183                 seq_puts(m, " ");
1184         }
1185
1186         if (entry->flags & IMA_PCR) {
1187                 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1188                 seq_printf(m, pt(Opt_pcr), tbuf);
1189                 seq_puts(m, " ");
1190         }
1191
1192         if (entry->flags & IMA_FSUUID) {
1193                 seq_printf(m, "fsuuid=%pU", &entry->fsuuid);
1194                 seq_puts(m, " ");
1195         }
1196
1197         if (entry->flags & IMA_UID) {
1198                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1199                 if (entry->uid_op == &uid_gt)
1200                         seq_printf(m, pt(Opt_uid_gt), tbuf);
1201                 else if (entry->uid_op == &uid_lt)
1202                         seq_printf(m, pt(Opt_uid_lt), tbuf);
1203                 else
1204                         seq_printf(m, pt(Opt_uid_eq), tbuf);
1205                 seq_puts(m, " ");
1206         }
1207
1208         if (entry->flags & IMA_EUID) {
1209                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1210                 if (entry->uid_op == &uid_gt)
1211                         seq_printf(m, pt(Opt_euid_gt), tbuf);
1212                 else if (entry->uid_op == &uid_lt)
1213                         seq_printf(m, pt(Opt_euid_lt), tbuf);
1214                 else
1215                         seq_printf(m, pt(Opt_euid_eq), tbuf);
1216                 seq_puts(m, " ");
1217         }
1218
1219         if (entry->flags & IMA_FOWNER) {
1220                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1221                 if (entry->fowner_op == &uid_gt)
1222                         seq_printf(m, pt(Opt_fowner_gt), tbuf);
1223                 else if (entry->fowner_op == &uid_lt)
1224                         seq_printf(m, pt(Opt_fowner_lt), tbuf);
1225                 else
1226                         seq_printf(m, pt(Opt_fowner_eq), tbuf);
1227                 seq_puts(m, " ");
1228         }
1229
1230         for (i = 0; i < MAX_LSM_RULES; i++) {
1231                 if (entry->lsm[i].rule) {
1232                         switch (i) {
1233                         case LSM_OBJ_USER:
1234                                 seq_printf(m, pt(Opt_obj_user),
1235                                            (char *)entry->lsm[i].args_p);
1236                                 break;
1237                         case LSM_OBJ_ROLE:
1238                                 seq_printf(m, pt(Opt_obj_role),
1239                                            (char *)entry->lsm[i].args_p);
1240                                 break;
1241                         case LSM_OBJ_TYPE:
1242                                 seq_printf(m, pt(Opt_obj_type),
1243                                            (char *)entry->lsm[i].args_p);
1244                                 break;
1245                         case LSM_SUBJ_USER:
1246                                 seq_printf(m, pt(Opt_subj_user),
1247                                            (char *)entry->lsm[i].args_p);
1248                                 break;
1249                         case LSM_SUBJ_ROLE:
1250                                 seq_printf(m, pt(Opt_subj_role),
1251                                            (char *)entry->lsm[i].args_p);
1252                                 break;
1253                         case LSM_SUBJ_TYPE:
1254                                 seq_printf(m, pt(Opt_subj_type),
1255                                            (char *)entry->lsm[i].args_p);
1256                                 break;
1257                         }
1258                 }
1259         }
1260         if (entry->flags & IMA_DIGSIG_REQUIRED)
1261                 seq_puts(m, "appraise_type=imasig ");
1262         if (entry->flags & IMA_PERMIT_DIRECTIO)
1263                 seq_puts(m, "permit_directio ");
1264         rcu_read_unlock();
1265         seq_puts(m, "\n");
1266         return 0;
1267 }
1268 #endif  /* CONFIG_IMA_READ_POLICY */