~hc/RK356X_SDK_RELEASE.git

..	..	@@ -1,17 +1,15 @@
	1	+// SPDX-License-Identifier: GPL-2.0-only
1	2	/*
2	3	* Copyright (C) 2008 IBM Corporation
3	4	* Author: Mimi Zohar <zohar@us.ibm.com>
4	5	*
5		- * This program is free software; you can redistribute it and/or modify
6		- * it under the terms of the GNU General Public License as published by
7		- * the Free Software Foundation, version 2 of the License.
8		- *
9	6	* ima_policy.c
10	7	* - initialize default measure policy rules
11		- *
12	8	*/
13		-#include <linux/module.h>
	9	+
	10	+#include <linux/init.h>
14	11	#include <linux/list.h>
	12	+#include <linux/kernel_read_file.h>
15	13	#include <linux/fs.h>
16	14	#include <linux/security.h>
17	15	#include <linux/magic.h>
..	..	@@ -20,6 +18,7 @@
20	18	#include <linux/rculist.h>
21	19	#include <linux/genhd.h>
22	20	#include <linux/seq_file.h>
	21	+#include <linux/ima.h>
23	22
24	23	#include "ima.h"
25	24
..	..	@@ -34,6 +33,7 @@
34	33	#define IMA_EUID 0x0080
35	34	#define IMA_PCR 0x0100
36	35	#define IMA_FSNAME 0x0200
	36	+#define IMA_KEYRINGS 0x0400
37	37
38	38	#define UNKNOWN 0
39	39	#define MEASURE 0x0001 /* same as IMA_MEASURE */
..	..	@@ -45,7 +45,7 @@
45	45	#define DONT_HASH 0x0200
46	46
47	47	#define INVALID_PCR(a) (((a) < 0) \|\| \
48		- (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
	48	+ (a) >= (sizeof_field(struct integrity_iint_cache, measured_pcrs) * 8))
49	49
50	50	int ima_policy_flag;
51	51	static int temp_ima_appraise;
..	..	@@ -57,6 +57,13 @@
57	57	};
58	58
59	59	enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
	60	+
	61	+enum policy_rule_list { IMA_DEFAULT_POLICY = 1, IMA_CUSTOM_POLICY };
	62	+
	63	+struct ima_rule_opt_list {
	64	+ size_t count;
	65	+ char *items[];
	66	+};
60	67
61	68	struct ima_rule_entry {
62	69	struct list_head list;
..	..	@@ -73,10 +80,12 @@
73	80	int pcr;
74	81	struct {
75	82	void rule; / LSM file metadata specific */
76		- void args_p; / audit value */
	83	+ char args_p; / audit value */
77	84	int type; /* audit type */
78	85	} lsm[MAX_LSM_RULES];
79	86	char *fsname;
	87	+ struct ima_rule_opt_list keyrings; / Measure keys added to these keyrings */
	88	+ struct ima_template_desc *template;
80	89	};
81	90
82	91	/*
..	..	@@ -104,7 +113,8 @@
104	113	.flags = IMA_FSMAGIC},
105	114	{.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC,
106	115	.flags = IMA_FSMAGIC},
107		- {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
	116	+ {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
	117	+ {.action = DONT_MEASURE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC}
108	118	};
109	119
110	120	static struct ima_rule_entry original_measurement_rules[] __ro_after_init = {
..	..	@@ -147,6 +157,7 @@
147	157	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
148	158	{.action = DONT_APPRAISE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
149	159	{.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
	160	+ {.action = DONT_APPRAISE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC},
150	161	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
151	162	{.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC},
152	163	#ifdef CONFIG_IMA_WRITE_POLICY
..	..	@@ -193,6 +204,9 @@
193	204	.flags = IMA_FUNC \| IMA_DIGSIG_REQUIRED},
194	205	};
195	206
	207	+/* An array of architecture specific rules */
	208	+static struct ima_rule_entry *arch_policy_entry __ro_after_init;
	209	+
196	210	static LIST_HEAD(ima_default_rules);
197	211	static LIST_HEAD(ima_policy_rules);
198	212	static LIST_HEAD(ima_temp_rules);
..	..	@@ -228,6 +242,8 @@
228	242	ima_use_secure_boot = true;
229	243	else if (strcmp(p, "fail_securely") == 0)
230	244	ima_fail_unverifiable_sigs = true;
	245	+ else
	246	+ pr_err("policy \"%s\" not found", p);
231	247	}
232	248
233	249	return 1;
..	..	@@ -241,48 +257,257 @@
241	257	}
242	258	__setup("ima_appraise_tcb", default_appraise_policy_setup);
243	259
	260	+static struct ima_rule_opt_list ima_alloc_rule_opt_list(const substring_t src)
	261	+{
	262	+ struct ima_rule_opt_list *opt_list;
	263	+ size_t count = 0;
	264	+ char *src_copy;
	265	+ char cur, next;
	266	+ size_t i;
	267	+
	268	+ src_copy = match_strdup(src);
	269	+ if (!src_copy)
	270	+ return ERR_PTR(-ENOMEM);
	271	+
	272	+ next = src_copy;
	273	+ while ((cur = strsep(&next, "\|"))) {
	274	+ /* Don't accept an empty list item */
	275	+ if (!(*cur)) {
	276	+ kfree(src_copy);
	277	+ return ERR_PTR(-EINVAL);
	278	+ }
	279	+ count++;
	280	+ }
	281	+
	282	+ /* Don't accept an empty list */
	283	+ if (!count) {
	284	+ kfree(src_copy);
	285	+ return ERR_PTR(-EINVAL);
	286	+ }
	287	+
	288	+ opt_list = kzalloc(struct_size(opt_list, items, count), GFP_KERNEL);
	289	+ if (!opt_list) {
	290	+ kfree(src_copy);
	291	+ return ERR_PTR(-ENOMEM);
	292	+ }
	293	+
	294	+ /*
	295	+ * strsep() has already replaced all instances of '\|' with '\0',
	296	+ * leaving a byte sequence of NUL-terminated strings. Reference each
	297	+ * string with the array of items.
	298	+ *
	299	+ * IMPORTANT: Ownership of the allocated buffer is transferred from
	300	+ * src_copy to the first element in the items array. To free the
	301	+ * buffer, kfree() must only be called on the first element of the
	302	+ * array.
	303	+ */
	304	+ for (i = 0, cur = src_copy; i < count; i++) {
	305	+ opt_list->items[i] = cur;
	306	+ cur = strchr(cur, '\0') + 1;
	307	+ }
	308	+ opt_list->count = count;
	309	+
	310	+ return opt_list;
	311	+}
	312	+
	313	+static void ima_free_rule_opt_list(struct ima_rule_opt_list *opt_list)
	314	+{
	315	+ if (!opt_list)
	316	+ return;
	317	+
	318	+ if (opt_list->count) {
	319	+ kfree(opt_list->items[0]);
	320	+ opt_list->count = 0;
	321	+ }
	322	+
	323	+ kfree(opt_list);
	324	+}
	325	+
	326	+static void ima_lsm_free_rule(struct ima_rule_entry *entry)
	327	+{
	328	+ int i;
	329	+
	330	+ for (i = 0; i < MAX_LSM_RULES; i++) {
	331	+ ima_filter_rule_free(entry->lsm[i].rule);
	332	+ kfree(entry->lsm[i].args_p);
	333	+ }
	334	+}
	335	+
	336	+static void ima_free_rule(struct ima_rule_entry *entry)
	337	+{
	338	+ if (!entry)
	339	+ return;
	340	+
	341	+ /*
	342	+ * entry->template->fields may be allocated in ima_parse_rule() but that
	343	+ * reference is owned by the corresponding ima_template_desc element in
	344	+ * the defined_templates list and cannot be freed here
	345	+ */
	346	+ kfree(entry->fsname);
	347	+ ima_free_rule_opt_list(entry->keyrings);
	348	+ ima_lsm_free_rule(entry);
	349	+ kfree(entry);
	350	+}
	351	+
	352	+static struct ima_rule_entry ima_lsm_copy_rule(struct ima_rule_entry entry)
	353	+{
	354	+ struct ima_rule_entry *nentry;
	355	+ int i;
	356	+
	357	+ /*
	358	+ * Immutable elements are copied over as pointers and data; only
	359	+ * lsm rules can change
	360	+ */
	361	+ nentry = kmemdup(entry, sizeof(*nentry), GFP_KERNEL);
	362	+ if (!nentry)
	363	+ return NULL;
	364	+
	365	+ memset(nentry->lsm, 0, sizeof_field(struct ima_rule_entry, lsm));
	366	+
	367	+ for (i = 0; i < MAX_LSM_RULES; i++) {
	368	+ if (!entry->lsm[i].args_p)
	369	+ continue;
	370	+
	371	+ nentry->lsm[i].type = entry->lsm[i].type;
	372	+ nentry->lsm[i].args_p = entry->lsm[i].args_p;
	373	+ /*
	374	+ * Remove the reference from entry so that the associated
	375	+ * memory will not be freed during a later call to
	376	+ * ima_lsm_free_rule(entry).
	377	+ */
	378	+ entry->lsm[i].args_p = NULL;
	379	+
	380	+ ima_filter_rule_init(nentry->lsm[i].type, Audit_equal,
	381	+ nentry->lsm[i].args_p,
	382	+ &nentry->lsm[i].rule);
	383	+ if (!nentry->lsm[i].rule)
	384	+ pr_warn("rule for LSM \'%s\' is undefined\n",
	385	+ nentry->lsm[i].args_p);
	386	+ }
	387	+ return nentry;
	388	+}
	389	+
	390	+static int ima_lsm_update_rule(struct ima_rule_entry *entry)
	391	+{
	392	+ struct ima_rule_entry *nentry;
	393	+
	394	+ nentry = ima_lsm_copy_rule(entry);
	395	+ if (!nentry)
	396	+ return -ENOMEM;
	397	+
	398	+ list_replace_rcu(&entry->list, &nentry->list);
	399	+ synchronize_rcu();
	400	+ /*
	401	+ * ima_lsm_copy_rule() shallow copied all references, except for the
	402	+ * LSM references, from entry to nentry so we only want to free the LSM
	403	+ * references and the entry itself. All other memory refrences will now
	404	+ * be owned by nentry.
	405	+ */
	406	+ ima_lsm_free_rule(entry);
	407	+ kfree(entry);
	408	+
	409	+ return 0;
	410	+}
	411	+
	412	+static bool ima_rule_contains_lsm_cond(struct ima_rule_entry *entry)
	413	+{
	414	+ int i;
	415	+
	416	+ for (i = 0; i < MAX_LSM_RULES; i++)
	417	+ if (entry->lsm[i].args_p)
	418	+ return true;
	419	+
	420	+ return false;
	421	+}
	422	+
244	423	/*
245	424	* The LSM policy can be reloaded, leaving the IMA LSM based rules referring
246	425	* to the old, stale LSM policy. Update the IMA LSM based rules to reflect
247		- * the reloaded LSM policy. We assume the rules still exist; and BUG_ON() if
248		- * they don't.
	426	+ * the reloaded LSM policy.
249	427	*/
250	428	static void ima_lsm_update_rules(void)
251	429	{
252		- struct ima_rule_entry *entry;
	430	+ struct ima_rule_entry entry, e;
253	431	int result;
254		- int i;
255	432
256		- list_for_each_entry(entry, &ima_policy_rules, list) {
257		- for (i = 0; i < MAX_LSM_RULES; i++) {
258		- if (!entry->lsm[i].rule)
259		- continue;
260		- result = security_filter_rule_init(entry->lsm[i].type,
261		- Audit_equal,
262		- entry->lsm[i].args_p,
263		- &entry->lsm[i].rule);
264		- BUG_ON(!entry->lsm[i].rule);
	433	+ list_for_each_entry_safe(entry, e, &ima_policy_rules, list) {
	434	+ if (!ima_rule_contains_lsm_cond(entry))
	435	+ continue;
	436	+
	437	+ result = ima_lsm_update_rule(entry);
	438	+ if (result) {
	439	+ pr_err("lsm rule update error %d\n", result);
	440	+ return;
265	441	}
266	442	}
267	443	}
268	444
	445	+int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
	446	+ void *lsm_data)
	447	+{
	448	+ if (event != LSM_POLICY_CHANGE)
	449	+ return NOTIFY_DONE;
	450	+
	451	+ ima_lsm_update_rules();
	452	+ return NOTIFY_OK;
	453	+}
	454	+
269	455	/**
270		- * ima_match_rules - determine whether an inode matches the measure rule.
	456	+ * ima_match_keyring - determine whether the keyring matches the measure rule
	457	+ * @rule: a pointer to a rule
	458	+ * @keyring: name of the keyring to match against the measure rule
	459	+ * @cred: a pointer to a credentials structure for user validation
	460	+ *
	461	+ * Returns true if keyring matches one in the rule, false otherwise.
	462	+ */
	463	+static bool ima_match_keyring(struct ima_rule_entry *rule,
	464	+ const char keyring, const struct cred cred)
	465	+{
	466	+ bool matched = false;
	467	+ size_t i;
	468	+
	469	+ if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
	470	+ return false;
	471	+
	472	+ if (!rule->keyrings)
	473	+ return true;
	474	+
	475	+ if (!keyring)
	476	+ return false;
	477	+
	478	+ for (i = 0; i < rule->keyrings->count; i++) {
	479	+ if (!strcmp(rule->keyrings->items[i], keyring)) {
	480	+ matched = true;
	481	+ break;
	482	+ }
	483	+ }
	484	+
	485	+ return matched;
	486	+}
	487	+
	488	+/**
	489	+ * ima_match_rules - determine whether an inode matches the policy rule.
271	490	* @rule: a pointer to a rule
272	491	* @inode: a pointer to an inode
273	492	* @cred: a pointer to a credentials structure for user validation
274	493	* @secid: the secid of the task to be validated
275	494	* @func: LIM hook identifier
276	495	* @mask: requested action (MAY_READ \| MAY_WRITE \| MAY_APPEND \| MAY_EXEC)
	496	+ * @keyring: keyring name to check in policy for KEY_CHECK func
277	497	*
278	498	* Returns true on rule match, false on failure.
279	499	*/
280	500	static bool ima_match_rules(struct ima_rule_entry rule, struct inode inode,
281	501	const struct cred *cred, u32 secid,
282		- enum ima_hooks func, int mask)
	502	+ enum ima_hooks func, int mask,
	503	+ const char *keyring)
283	504	{
284	505	int i;
285	506
	507	+ if (func == KEY_CHECK) {
	508	+ return (rule->flags & IMA_FUNC) && (rule->func == func) &&
	509	+ ima_match_keyring(rule, keyring, cred);
	510	+ }
286	511	if ((rule->flags & IMA_FUNC) &&
287	512	(rule->func != func && func != POST_SETATTR))
288	513	return false;
..	..	@@ -319,37 +544,30 @@
319	544	for (i = 0; i < MAX_LSM_RULES; i++) {
320	545	int rc = 0;
321	546	u32 osid;
322		- int retried = 0;
323	547
324		- if (!rule->lsm[i].rule)
325		- continue;
326		-retry:
	548	+ if (!rule->lsm[i].rule) {
	549	+ if (!rule->lsm[i].args_p)
	550	+ continue;
	551	+ else
	552	+ return false;
	553	+ }
327	554	switch (i) {
328	555	case LSM_OBJ_USER:
329	556	case LSM_OBJ_ROLE:
330	557	case LSM_OBJ_TYPE:
331	558	security_inode_getsecid(inode, &osid);
332		- rc = security_filter_rule_match(osid,
333		- rule->lsm[i].type,
334		- Audit_equal,
335		- rule->lsm[i].rule,
336		- NULL);
	559	+ rc = ima_filter_rule_match(osid, rule->lsm[i].type,
	560	+ Audit_equal,
	561	+ rule->lsm[i].rule);
337	562	break;
338	563	case LSM_SUBJ_USER:
339	564	case LSM_SUBJ_ROLE:
340	565	case LSM_SUBJ_TYPE:
341		- rc = security_filter_rule_match(secid,
342		- rule->lsm[i].type,
343		- Audit_equal,
344		- rule->lsm[i].rule,
345		- NULL);
	566	+ rc = ima_filter_rule_match(secid, rule->lsm[i].type,
	567	+ Audit_equal,
	568	+ rule->lsm[i].rule);
346	569	default:
347	570	break;
348		- }
349		- if ((rc < 0) && (!retried)) {
350		- retried = 1;
351		- ima_lsm_update_rules();
352		- goto retry;
353	571	}
354	572	if (!rc)
355	573	return false;
..	..	@@ -391,6 +609,9 @@
391	609	* @func: IMA hook identifier
392	610	* @mask: requested action (MAY_READ \| MAY_WRITE \| MAY_APPEND \| MAY_EXEC)
393	611	* @pcr: set the pcr to extend
	612	+ * @template_desc: the template that should be used for this rule
	613	+ * @keyring: the keyring name, if given, to be used to check in the policy.
	614	+ * keyring can be NULL if func is anything other than KEY_CHECK.
394	615	*
395	616	* Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
396	617	* conditions.
..	..	@@ -400,10 +621,15 @@
400	621	* than writes so ima_match_policy() is classical RCU candidate.
401	622	*/
402	623	int ima_match_policy(struct inode inode, const struct cred cred, u32 secid,
403		- enum ima_hooks func, int mask, int flags, int *pcr)
	624	+ enum ima_hooks func, int mask, int flags, int *pcr,
	625	+ struct ima_template_desc **template_desc,
	626	+ const char *keyring)
404	627	{
405	628	struct ima_rule_entry *entry;
406	629	int action = 0, actmask = flags \| (flags << 1);
	630	+
	631	+ if (template_desc)
	632	+ *template_desc = ima_template_desc_current();
407	633
408	634	rcu_read_lock();
409	635	list_for_each_entry_rcu(entry, ima_rules, list) {
..	..	@@ -411,7 +637,8 @@
411	637	if (!(entry->action & actmask))
412	638	continue;
413	639
414		- if (!ima_match_rules(entry, inode, cred, secid, func, mask))
	640	+ if (!ima_match_rules(entry, inode, cred, secid, func, mask,
	641	+ keyring))
415	642	continue;
416	643
417	644	action \|= entry->flags & IMA_ACTION_FLAGS;
..	..	@@ -424,6 +651,7 @@
424	651	action \|= IMA_FAIL_UNVERIFIABLE_SIGS;
425	652	}
426	653
	654	+
427	655	if (entry->action & IMA_DO_MASK)
428	656	actmask &= ~(entry->action \| entry->action << 1);
429	657	else
..	..	@@ -431,6 +659,9 @@
431	659
432	660	if ((pcr) && (entry->flags & IMA_PCR))
433	661	*pcr = entry->pcr;
	662	+
	663	+ if (template_desc && entry->template)
	664	+ *template_desc = entry->template;
434	665
435	666	if (!actmask)
436	667	break;
..	..	@@ -473,6 +704,79 @@
473	704	return 0;
474	705	}
475	706
	707	+static void add_rules(struct ima_rule_entry *entries, int count,
	708	+ enum policy_rule_list policy_rule)
	709	+{
	710	+ int i = 0;
	711	+
	712	+ for (i = 0; i < count; i++) {
	713	+ struct ima_rule_entry *entry;
	714	+
	715	+ if (policy_rule & IMA_DEFAULT_POLICY)
	716	+ list_add_tail(&entries[i].list, &ima_default_rules);
	717	+
	718	+ if (policy_rule & IMA_CUSTOM_POLICY) {
	719	+ entry = kmemdup(&entries[i], sizeof(*entry),
	720	+ GFP_KERNEL);
	721	+ if (!entry)
	722	+ continue;
	723	+
	724	+ list_add_tail(&entry->list, &ima_policy_rules);
	725	+ }
	726	+ if (entries[i].action == APPRAISE) {
	727	+ if (entries != build_appraise_rules)
	728	+ temp_ima_appraise \|=
	729	+ ima_appraise_flag(entries[i].func);
	730	+ else
	731	+ build_ima_appraise \|=
	732	+ ima_appraise_flag(entries[i].func);
	733	+ }
	734	+ }
	735	+}
	736	+
	737	+static int ima_parse_rule(char rule, struct ima_rule_entry entry);
	738	+
	739	+static int __init ima_init_arch_policy(void)
	740	+{
	741	+ const char * const *arch_rules;
	742	+ const char * const *rules;
	743	+ int arch_entries = 0;
	744	+ int i = 0;
	745	+
	746	+ arch_rules = arch_get_ima_policy();
	747	+ if (!arch_rules)
	748	+ return arch_entries;
	749	+
	750	+ /* Get number of rules */
	751	+ for (rules = arch_rules; *rules != NULL; rules++)
	752	+ arch_entries++;
	753	+
	754	+ arch_policy_entry = kcalloc(arch_entries + 1,
	755	+ sizeof(*arch_policy_entry), GFP_KERNEL);
	756	+ if (!arch_policy_entry)
	757	+ return 0;
	758	+
	759	+ /* Convert each policy string rules to struct ima_rule_entry format */
	760	+ for (rules = arch_rules, i = 0; *rules != NULL; rules++) {
	761	+ char rule[255];
	762	+ int result;
	763	+
	764	+ result = strlcpy(rule, *rules, sizeof(rule));
	765	+
	766	+ INIT_LIST_HEAD(&arch_policy_entry[i].list);
	767	+ result = ima_parse_rule(rule, &arch_policy_entry[i]);
	768	+ if (result) {
	769	+ pr_warn("Skipping unknown architecture policy rule: %s\n",
	770	+ rule);
	771	+ memset(&arch_policy_entry[i], 0,
	772	+ sizeof(*arch_policy_entry));
	773	+ continue;
	774	+ }
	775	+ i++;
	776	+ }
	777	+ return i;
	778	+}
	779	+
476	780	/**
477	781	* ima_init_policy - initialize the default measure rules.
478	782	*
..	..	@@ -481,68 +785,68 @@
481	785	*/
482	786	void __init ima_init_policy(void)
483	787	{
484		- int i, measure_entries, appraise_entries, secure_boot_entries;
	788	+ int build_appraise_entries, arch_entries;
485	789
486		- /* if !ima_policy set entries = 0 so we load NO default rules */
487		- measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
488		- appraise_entries = ima_use_appraise_tcb ?
489		- ARRAY_SIZE(default_appraise_rules) : 0;
490		- secure_boot_entries = ima_use_secure_boot ?
491		- ARRAY_SIZE(secure_boot_rules) : 0;
492		-
493		- for (i = 0; i < measure_entries; i++)
494		- list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
	790	+ /* if !ima_policy, we load NO default rules */
	791	+ if (ima_policy)
	792	+ add_rules(dont_measure_rules, ARRAY_SIZE(dont_measure_rules),
	793	+ IMA_DEFAULT_POLICY);
495	794
496	795	switch (ima_policy) {
497	796	case ORIGINAL_TCB:
498		- for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
499		- list_add_tail(&original_measurement_rules[i].list,
500		- &ima_default_rules);
	797	+ add_rules(original_measurement_rules,
	798	+ ARRAY_SIZE(original_measurement_rules),
	799	+ IMA_DEFAULT_POLICY);
501	800	break;
502	801	case DEFAULT_TCB:
503		- for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
504		- list_add_tail(&default_measurement_rules[i].list,
505		- &ima_default_rules);
	802	+ add_rules(default_measurement_rules,
	803	+ ARRAY_SIZE(default_measurement_rules),
	804	+ IMA_DEFAULT_POLICY);
506	805	default:
507	806	break;
508	807	}
509	808
510	809	/*
511		- * Insert the builtin "secure_boot" policy rules requiring file
512		- * signatures, prior to any other appraise rules.
	810	+ * Based on runtime secure boot flags, insert arch specific measurement
	811	+ * and appraise rules requiring file signatures for both the initial
	812	+ * and custom policies, prior to other appraise rules.
	813	+ * (Highest priority)
513	814	*/
514		- for (i = 0; i < secure_boot_entries; i++) {
515		- list_add_tail(&secure_boot_rules[i].list, &ima_default_rules);
516		- temp_ima_appraise \|=
517		- ima_appraise_flag(secure_boot_rules[i].func);
518		- }
	815	+ arch_entries = ima_init_arch_policy();
	816	+ if (!arch_entries)
	817	+ pr_info("No architecture policies found\n");
	818	+ else
	819	+ add_rules(arch_policy_entry, arch_entries,
	820	+ IMA_DEFAULT_POLICY \| IMA_CUSTOM_POLICY);
	821	+
	822	+ /*
	823	+ * Insert the builtin "secure_boot" policy rules requiring file
	824	+ * signatures, prior to other appraise rules.
	825	+ */
	826	+ if (ima_use_secure_boot)
	827	+ add_rules(secure_boot_rules, ARRAY_SIZE(secure_boot_rules),
	828	+ IMA_DEFAULT_POLICY);
519	829
520	830	/*
521	831	* Insert the build time appraise rules requiring file signatures
522	832	* for both the initial and custom policies, prior to other appraise
523		- * rules.
	833	+ * rules. As the secure boot rules includes all of the build time
	834	+ * rules, include either one or the other set of rules, but not both.
524	835	*/
525		- for (i = 0; i < ARRAY_SIZE(build_appraise_rules); i++) {
526		- struct ima_rule_entry *entry;
527		-
528		- if (!secure_boot_entries)
529		- list_add_tail(&build_appraise_rules[i].list,
530		- &ima_default_rules);
531		-
532		- entry = kmemdup(&build_appraise_rules[i], sizeof(*entry),
533		- GFP_KERNEL);
534		- if (entry)
535		- list_add_tail(&entry->list, &ima_policy_rules);
536		- build_ima_appraise \|=
537		- ima_appraise_flag(build_appraise_rules[i].func);
	836	+ build_appraise_entries = ARRAY_SIZE(build_appraise_rules);
	837	+ if (build_appraise_entries) {
	838	+ if (ima_use_secure_boot)
	839	+ add_rules(build_appraise_rules, build_appraise_entries,
	840	+ IMA_CUSTOM_POLICY);
	841	+ else
	842	+ add_rules(build_appraise_rules, build_appraise_entries,
	843	+ IMA_DEFAULT_POLICY \| IMA_CUSTOM_POLICY);
538	844	}
539	845
540		- for (i = 0; i < appraise_entries; i++) {
541		- list_add_tail(&default_appraise_rules[i].list,
542		- &ima_default_rules);
543		- if (default_appraise_rules[i].func == POLICY_CHECK)
544		- temp_ima_appraise \|= IMA_APPRAISE_POLICY;
545		- }
	846	+ if (ima_use_appraise_tcb)
	847	+ add_rules(default_appraise_rules,
	848	+ ARRAY_SIZE(default_appraise_rules),
	849	+ IMA_DEFAULT_POLICY);
546	850
547	851	ima_update_policy_flag();
548	852	}
..	..	@@ -575,13 +879,24 @@
575	879	if (ima_rules != policy) {
576	880	ima_policy_flag = 0;
577	881	ima_rules = policy;
	882	+
	883	+ /*
	884	+ * IMA architecture specific policy rules are specified
	885	+ * as strings and converted to an array of ima_entry_rules
	886	+ * on boot. After loading a custom policy, free the
	887	+ * architecture specific rules stored as an array.
	888	+ */
	889	+ kfree(arch_policy_entry);
578	890	}
579	891	ima_update_policy_flag();
	892	+
	893	+ /* Custom IMA policy has been loaded */
	894	+ ima_process_queued_keys();
580	895	}
581	896
	897	+/* Keep the enumeration in sync with the policy_tokens! */
582	898	enum {
583		- Opt_err = -1,
584		- Opt_measure = 1, Opt_dont_measure,
	899	+ Opt_measure, Opt_dont_measure,
585	900	Opt_appraise, Opt_dont_appraise,
586	901	Opt_audit, Opt_hash, Opt_dont_hash,
587	902	Opt_obj_user, Opt_obj_role, Opt_obj_type,
..	..	@@ -590,11 +905,12 @@
590	905	Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq,
591	906	Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt,
592	907	Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt,
593		- Opt_appraise_type, Opt_permit_directio,
594		- Opt_pcr
	908	+ Opt_appraise_type, Opt_appraise_flag,
	909	+ Opt_permit_directio, Opt_pcr, Opt_template, Opt_keyrings,
	910	+ Opt_err
595	911	};
596	912
597		-static match_table_t policy_tokens = {
	913	+static const match_table_t policy_tokens = {
598	914	{Opt_measure, "measure"},
599	915	{Opt_dont_measure, "dont_measure"},
600	916	{Opt_appraise, "appraise"},
..	..	@@ -623,8 +939,11 @@
623	939	{Opt_euid_lt, "euid<%s"},
624	940	{Opt_fowner_lt, "fowner<%s"},
625	941	{Opt_appraise_type, "appraise_type=%s"},
	942	+ {Opt_appraise_flag, "appraise_flag=%s"},
626	943	{Opt_permit_directio, "permit_directio"},
627	944	{Opt_pcr, "pcr=%s"},
	945	+ {Opt_template, "template=%s"},
	946	+ {Opt_keyrings, "keyrings=%s"},
628	947	{Opt_err, NULL}
629	948	};
630	949
..	..	@@ -641,13 +960,19 @@
641	960	return -ENOMEM;
642	961
643	962	entry->lsm[lsm_rule].type = audit_type;
644		- result = security_filter_rule_init(entry->lsm[lsm_rule].type,
645		- Audit_equal,
646		- entry->lsm[lsm_rule].args_p,
647		- &entry->lsm[lsm_rule].rule);
	963	+ result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal,
	964	+ entry->lsm[lsm_rule].args_p,
	965	+ &entry->lsm[lsm_rule].rule);
648	966	if (!entry->lsm[lsm_rule].rule) {
649		- kfree(entry->lsm[lsm_rule].args_p);
650		- return -EINVAL;
	967	+ pr_warn("rule for LSM \'%s\' is undefined\n",
	968	+ entry->lsm[lsm_rule].args_p);
	969	+
	970	+ if (ima_rules == &ima_default_rules) {
	971	+ kfree(entry->lsm[lsm_rule].args_p);
	972	+ entry->lsm[lsm_rule].args_p = NULL;
	973	+ result = -EINVAL;
	974	+ } else
	975	+ result = 0;
651	976	}
652	977
653	978	return result;
..	..	@@ -672,12 +997,135 @@
672	997	ima_log_string_op(ab, key, value, NULL);
673	998	}
674	999
	1000	+/*
	1001	+ * Validating the appended signature included in the measurement list requires
	1002	+ * the file hash calculated without the appended signature (i.e., the 'd-modsig'
	1003	+ * field). Therefore, notify the user if they have the 'modsig' field but not
	1004	+ * the 'd-modsig' field in the template.
	1005	+ */
	1006	+static void check_template_modsig(const struct ima_template_desc *template)
	1007	+{
	1008	+#define MSG "template with 'modsig' field also needs 'd-modsig' field\n"
	1009	+ bool has_modsig, has_dmodsig;
	1010	+ static bool checked;
	1011	+ int i;
	1012	+
	1013	+ /* We only need to notify the user once. */
	1014	+ if (checked)
	1015	+ return;
	1016	+
	1017	+ has_modsig = has_dmodsig = false;
	1018	+ for (i = 0; i < template->num_fields; i++) {
	1019	+ if (!strcmp(template->fields[i]->field_id, "modsig"))
	1020	+ has_modsig = true;
	1021	+ else if (!strcmp(template->fields[i]->field_id, "d-modsig"))
	1022	+ has_dmodsig = true;
	1023	+ }
	1024	+
	1025	+ if (has_modsig && !has_dmodsig)
	1026	+ pr_notice(MSG);
	1027	+
	1028	+ checked = true;
	1029	+#undef MSG
	1030	+}
	1031	+
	1032	+static bool ima_validate_rule(struct ima_rule_entry *entry)
	1033	+{
	1034	+ /* Ensure that the action is set and is compatible with the flags */
	1035	+ if (entry->action == UNKNOWN)
	1036	+ return false;
	1037	+
	1038	+ if (entry->action != MEASURE && entry->flags & IMA_PCR)
	1039	+ return false;
	1040	+
	1041	+ if (entry->action != APPRAISE &&
	1042	+ entry->flags & (IMA_DIGSIG_REQUIRED \| IMA_MODSIG_ALLOWED \| IMA_CHECK_BLACKLIST))
	1043	+ return false;
	1044	+
	1045	+ /*
	1046	+ * The IMA_FUNC bit must be set if and only if there's a valid hook
	1047	+ * function specified, and vice versa. Enforcing this property allows
	1048	+ * for the NONE case below to validate a rule without an explicit hook
	1049	+ * function.
	1050	+ */
	1051	+ if (((entry->flags & IMA_FUNC) && entry->func == NONE) \|\|
	1052	+ (!(entry->flags & IMA_FUNC) && entry->func != NONE))
	1053	+ return false;
	1054	+
	1055	+ /*
	1056	+ * Ensure that the hook function is compatible with the other
	1057	+ * components of the rule
	1058	+ */
	1059	+ switch (entry->func) {
	1060	+ case NONE:
	1061	+ case FILE_CHECK:
	1062	+ case MMAP_CHECK:
	1063	+ case BPRM_CHECK:
	1064	+ case CREDS_CHECK:
	1065	+ case POST_SETATTR:
	1066	+ case FIRMWARE_CHECK:
	1067	+ case POLICY_CHECK:
	1068	+ if (entry->flags & ~(IMA_FUNC \| IMA_MASK \| IMA_FSMAGIC \|
	1069	+ IMA_UID \| IMA_FOWNER \| IMA_FSUUID \|
	1070	+ IMA_INMASK \| IMA_EUID \| IMA_PCR \|
	1071	+ IMA_FSNAME \| IMA_DIGSIG_REQUIRED \|
	1072	+ IMA_PERMIT_DIRECTIO))
	1073	+ return false;
	1074	+
	1075	+ break;
	1076	+ case MODULE_CHECK:
	1077	+ case KEXEC_KERNEL_CHECK:
	1078	+ case KEXEC_INITRAMFS_CHECK:
	1079	+ if (entry->flags & ~(IMA_FUNC \| IMA_MASK \| IMA_FSMAGIC \|
	1080	+ IMA_UID \| IMA_FOWNER \| IMA_FSUUID \|
	1081	+ IMA_INMASK \| IMA_EUID \| IMA_PCR \|
	1082	+ IMA_FSNAME \| IMA_DIGSIG_REQUIRED \|
	1083	+ IMA_PERMIT_DIRECTIO \| IMA_MODSIG_ALLOWED \|
	1084	+ IMA_CHECK_BLACKLIST))
	1085	+ return false;
	1086	+
	1087	+ break;
	1088	+ case KEXEC_CMDLINE:
	1089	+ if (entry->action & ~(MEASURE \| DONT_MEASURE))
	1090	+ return false;
	1091	+
	1092	+ if (entry->flags & ~(IMA_FUNC \| IMA_FSMAGIC \| IMA_UID \|
	1093	+ IMA_FOWNER \| IMA_FSUUID \| IMA_EUID \|
	1094	+ IMA_PCR \| IMA_FSNAME))
	1095	+ return false;
	1096	+
	1097	+ break;
	1098	+ case KEY_CHECK:
	1099	+ if (entry->action & ~(MEASURE \| DONT_MEASURE))
	1100	+ return false;
	1101	+
	1102	+ if (entry->flags & ~(IMA_FUNC \| IMA_UID \| IMA_PCR \|
	1103	+ IMA_KEYRINGS))
	1104	+ return false;
	1105	+
	1106	+ if (ima_rule_contains_lsm_cond(entry))
	1107	+ return false;
	1108	+
	1109	+ break;
	1110	+ default:
	1111	+ return false;
	1112	+ }
	1113	+
	1114	+ /* Ensure that combinations of flags are compatible with each other */
	1115	+ if (entry->flags & IMA_CHECK_BLACKLIST &&
	1116	+ !(entry->flags & IMA_MODSIG_ALLOWED))
	1117	+ return false;
	1118	+
	1119	+ return true;
	1120	+}
	1121	+
675	1122	static int ima_parse_rule(char rule, struct ima_rule_entry entry)
676	1123	{
677	1124	struct audit_buffer *ab;
678	1125	char *from;
679	1126	char *p;
680	1127	bool uid_token;
	1128	+ struct ima_template_desc *template_desc;
681	1129	int result = 0;
682	1130
683	1131	ab = integrity_audit_log_start(audit_context(), GFP_KERNEL,
..	..	@@ -785,6 +1233,11 @@
785	1233	entry->func = KEXEC_INITRAMFS_CHECK;
786	1234	else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
787	1235	entry->func = POLICY_CHECK;
	1236	+ else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0)
	1237	+ entry->func = KEXEC_CMDLINE;
	1238	+ else if (IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) &&
	1239	+ strcmp(args[0].from, "KEY_CHECK") == 0)
	1240	+ entry->func = KEY_CHECK;
788	1241	else
789	1242	result = -EINVAL;
790	1243	if (!result)
..	..	@@ -837,6 +1290,24 @@
837	1290	result = 0;
838	1291	entry->flags \|= IMA_FSNAME;
839	1292	break;
	1293	+ case Opt_keyrings:
	1294	+ ima_log_string(ab, "keyrings", args[0].from);
	1295	+
	1296	+ if (!IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) \|\|
	1297	+ entry->keyrings) {
	1298	+ result = -EINVAL;
	1299	+ break;
	1300	+ }
	1301	+
	1302	+ entry->keyrings = ima_alloc_rule_opt_list(args);
	1303	+ if (IS_ERR(entry->keyrings)) {
	1304	+ result = PTR_ERR(entry->keyrings);
	1305	+ entry->keyrings = NULL;
	1306	+ break;
	1307	+ }
	1308	+
	1309	+ entry->flags \|= IMA_KEYRINGS;
	1310	+ break;
840	1311	case Opt_fsuuid:
841	1312	ima_log_string(ab, "fsuuid", args[0].from);
842	1313
..	..	@@ -852,10 +1323,12 @@
852	1323	case Opt_uid_gt:
853	1324	case Opt_euid_gt:
854	1325	entry->uid_op = &uid_gt;
	1326	+ fallthrough;
855	1327	case Opt_uid_lt:
856	1328	case Opt_euid_lt:
857	1329	if ((token == Opt_uid_lt) \|\| (token == Opt_euid_lt))
858	1330	entry->uid_op = &uid_lt;
	1331	+ fallthrough;
859	1332	case Opt_uid_eq:
860	1333	case Opt_euid_eq:
861	1334	uid_token = (token == Opt_uid_eq) \|\|
..	..	@@ -884,9 +1357,11 @@
884	1357	break;
885	1358	case Opt_fowner_gt:
886	1359	entry->fowner_op = &uid_gt;
	1360	+ fallthrough;
887	1361	case Opt_fowner_lt:
888	1362	if (token == Opt_fowner_lt)
889	1363	entry->fowner_op = &uid_lt;
	1364	+ fallthrough;
890	1365	case Opt_fowner_eq:
891	1366	ima_log_string_op(ab, "fowner", args[0].from,
892	1367	entry->fowner_op);
..	..	@@ -942,14 +1417,21 @@
942	1417	AUDIT_SUBJ_TYPE);
943	1418	break;
944	1419	case Opt_appraise_type:
945		- if (entry->action != APPRAISE) {
946		- result = -EINVAL;
947		- break;
948		- }
949		-
950	1420	ima_log_string(ab, "appraise_type", args[0].from);
951	1421	if ((strcmp(args[0].from, "imasig")) == 0)
952	1422	entry->flags \|= IMA_DIGSIG_REQUIRED;
	1423	+ else if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
	1424	+ strcmp(args[0].from, "imasig\|modsig") == 0)
	1425	+ entry->flags \|= IMA_DIGSIG_REQUIRED \|
	1426	+ IMA_MODSIG_ALLOWED;
	1427	+ else
	1428	+ result = -EINVAL;
	1429	+ break;
	1430	+ case Opt_appraise_flag:
	1431	+ ima_log_string(ab, "appraise_flag", args[0].from);
	1432	+ if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
	1433	+ strstr(args[0].from, "blacklist"))
	1434	+ entry->flags \|= IMA_CHECK_BLACKLIST;
953	1435	else
954	1436	result = -EINVAL;
955	1437	break;
..	..	@@ -957,10 +1439,6 @@
957	1439	entry->flags \|= IMA_PERMIT_DIRECTIO;
958	1440	break;
959	1441	case Opt_pcr:
960		- if (entry->action != MEASURE) {
961		- result = -EINVAL;
962		- break;
963		- }
964	1442	ima_log_string(ab, "pcr", args[0].from);
965	1443
966	1444	result = kstrtoint(args[0].from, 10, &entry->pcr);
..	..	@@ -970,16 +1448,44 @@
970	1448	entry->flags \|= IMA_PCR;
971	1449
972	1450	break;
	1451	+ case Opt_template:
	1452	+ ima_log_string(ab, "template", args[0].from);
	1453	+ if (entry->action != MEASURE) {
	1454	+ result = -EINVAL;
	1455	+ break;
	1456	+ }
	1457	+ template_desc = lookup_template_desc(args[0].from);
	1458	+ if (!template_desc \|\| entry->template) {
	1459	+ result = -EINVAL;
	1460	+ break;
	1461	+ }
	1462	+
	1463	+ /*
	1464	+ * template_desc_init_fields() does nothing if
	1465	+ * the template is already initialised, so
	1466	+ * it's safe to do this unconditionally
	1467	+ */
	1468	+ template_desc_init_fields(template_desc->fmt,
	1469	+ &(template_desc->fields),
	1470	+ &(template_desc->num_fields));
	1471	+ entry->template = template_desc;
	1472	+ break;
973	1473	case Opt_err:
974	1474	ima_log_string(ab, "UNKNOWN", p);
975	1475	result = -EINVAL;
976	1476	break;
977	1477	}
978	1478	}
979		- if (!result && (entry->action == UNKNOWN))
	1479	+ if (!result && !ima_validate_rule(entry))
980	1480	result = -EINVAL;
981	1481	else if (entry->action == APPRAISE)
982	1482	temp_ima_appraise \|= ima_appraise_flag(entry->func);
	1483	+
	1484	+ if (!result && entry->flags & IMA_MODSIG_ALLOWED) {
	1485	+ template_desc = entry->template ? entry->template :
	1486	+ ima_template_desc_current();
	1487	+ check_template_modsig(template_desc);
	1488	+ }
983	1489
984	1490	audit_log_format(ab, "res=%d", !result);
985	1491	audit_log_end(ab);
..	..	@@ -1019,7 +1525,7 @@
1019	1525
1020	1526	result = ima_parse_rule(p, entry);
1021	1527	if (result) {
1022		- kfree(entry);
	1528	+ ima_free_rule(entry);
1023	1529	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1024	1530	NULL, op, "invalid-policy", result,
1025	1531	audit_info);
..	..	@@ -1040,17 +1546,19 @@
1040	1546	void ima_delete_rules(void)
1041	1547	{
1042	1548	struct ima_rule_entry entry, tmp;
1043		- int i;
1044	1549
1045	1550	temp_ima_appraise = 0;
1046	1551	list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
1047		- for (i = 0; i < MAX_LSM_RULES; i++)
1048		- kfree(entry->lsm[i].args_p);
1049		-
1050	1552	list_del(&entry->list);
1051		- kfree(entry);
	1553	+ ima_free_rule(entry);
1052	1554	}
1053	1555	}
	1556	+
	1557	+#define __ima_hook_stringify(func, str) (#func),
	1558	+
	1559	+const char *const func_tokens[] = {
	1560	+ __ima_hooks(__ima_hook_stringify)
	1561	+};
1054	1562
1055	1563	#ifdef CONFIG_IMA_READ_POLICY
1056	1564	enum {
..	..	@@ -1062,12 +1570,6 @@
1062	1570	"^MAY_WRITE",
1063	1571	"^MAY_READ",
1064	1572	"^MAY_APPEND"
1065		-};
1066		-
1067		-#define __ima_hook_stringify(str) (#str),
1068		-
1069		-static const char *const func_tokens[] = {
1070		- __ima_hooks(__ima_hook_stringify)
1071	1573	};
1072	1574
1073	1575	void ima_policy_start(struct seq_file m, loff_t *pos)
..	..	@@ -1102,7 +1604,7 @@
1102	1604	{
1103	1605	}
1104	1606
1105		-#define pt(token) policy_tokens[token + Opt_err].pattern
	1607	+#define pt(token) policy_tokens[token].pattern
1106	1608	#define mt(token) mask_tokens[token]
1107	1609
1108	1610	/*
..	..	@@ -1116,6 +1618,15 @@
1116	1618	seq_printf(m, "func=%d ", func);
1117	1619	}
1118	1620
	1621	+static void ima_show_rule_opt_list(struct seq_file *m,
	1622	+ const struct ima_rule_opt_list *opt_list)
	1623	+{
	1624	+ size_t i;
	1625	+
	1626	+ for (i = 0; i < opt_list->count; i++)
	1627	+ seq_printf(m, "%s%s", i ? "\|" : "", opt_list->items[i]);
	1628	+}
	1629	+
1119	1630	int ima_policy_show(struct seq_file m, void v)
1120	1631	{
1121	1632	struct ima_rule_entry *entry = v;
..	..	@@ -1124,6 +1635,14 @@
1124	1635	int offset = 0;
1125	1636
1126	1637	rcu_read_lock();
	1638	+
	1639	+ /* Do not print rules with inactive LSM labels */
	1640	+ for (i = 0; i < MAX_LSM_RULES; i++) {
	1641	+ if (entry->lsm[i].args_p && !entry->lsm[i].rule) {
	1642	+ rcu_read_unlock();
	1643	+ return 0;
	1644	+ }
	1645	+ }
1127	1646
1128	1647	if (entry->action & MEASURE)
1129	1648	seq_puts(m, pt(Opt_measure));
..	..	@@ -1168,6 +1687,12 @@
1168	1687	if (entry->flags & IMA_FSNAME) {
1169	1688	snprintf(tbuf, sizeof(tbuf), "%s", entry->fsname);
1170	1689	seq_printf(m, pt(Opt_fsname), tbuf);
	1690	+ seq_puts(m, " ");
	1691	+ }
	1692	+
	1693	+ if (entry->flags & IMA_KEYRINGS) {
	1694	+ seq_puts(m, "keyrings=");
	1695	+ ima_show_rule_opt_list(m, entry->keyrings);
1171	1696	seq_puts(m, " ");
1172	1697	}
1173	1698
..	..	@@ -1220,33 +1745,42 @@
1220	1745	switch (i) {
1221	1746	case LSM_OBJ_USER:
1222	1747	seq_printf(m, pt(Opt_obj_user),
1223		- (char *)entry->lsm[i].args_p);
	1748	+ entry->lsm[i].args_p);
1224	1749	break;
1225	1750	case LSM_OBJ_ROLE:
1226	1751	seq_printf(m, pt(Opt_obj_role),
1227		- (char *)entry->lsm[i].args_p);
	1752	+ entry->lsm[i].args_p);
1228	1753	break;
1229	1754	case LSM_OBJ_TYPE:
1230	1755	seq_printf(m, pt(Opt_obj_type),
1231		- (char *)entry->lsm[i].args_p);
	1756	+ entry->lsm[i].args_p);
1232	1757	break;
1233	1758	case LSM_SUBJ_USER:
1234	1759	seq_printf(m, pt(Opt_subj_user),
1235		- (char *)entry->lsm[i].args_p);
	1760	+ entry->lsm[i].args_p);
1236	1761	break;
1237	1762	case LSM_SUBJ_ROLE:
1238	1763	seq_printf(m, pt(Opt_subj_role),
1239		- (char *)entry->lsm[i].args_p);
	1764	+ entry->lsm[i].args_p);
1240	1765	break;
1241	1766	case LSM_SUBJ_TYPE:
1242	1767	seq_printf(m, pt(Opt_subj_type),
1243		- (char *)entry->lsm[i].args_p);
	1768	+ entry->lsm[i].args_p);
1244	1769	break;
1245	1770	}
	1771	+ seq_puts(m, " ");
1246	1772	}
1247	1773	}
1248		- if (entry->flags & IMA_DIGSIG_REQUIRED)
1249		- seq_puts(m, "appraise_type=imasig ");
	1774	+ if (entry->template)
	1775	+ seq_printf(m, "template=%s ", entry->template->name);
	1776	+ if (entry->flags & IMA_DIGSIG_REQUIRED) {
	1777	+ if (entry->flags & IMA_MODSIG_ALLOWED)
	1778	+ seq_puts(m, "appraise_type=imasig\|modsig ");
	1779	+ else
	1780	+ seq_puts(m, "appraise_type=imasig ");
	1781	+ }
	1782	+ if (entry->flags & IMA_CHECK_BLACKLIST)
	1783	+ seq_puts(m, "appraise_flag=check_blacklist ");
1250	1784	if (entry->flags & IMA_PERMIT_DIRECTIO)
1251	1785	seq_puts(m, "permit_directio ");
1252	1786	rcu_read_unlock();
..	..	@@ -1254,3 +1788,57 @@
1254	1788	return 0;
1255	1789	}
1256	1790	#endif /* CONFIG_IMA_READ_POLICY */
	1791	+
	1792	+#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
	1793	+/*
	1794	+ * ima_appraise_signature: whether IMA will appraise a given function using
	1795	+ * an IMA digital signature. This is restricted to cases where the kernel
	1796	+ * has a set of built-in trusted keys in order to avoid an attacker simply
	1797	+ * loading additional keys.
	1798	+ */
	1799	+bool ima_appraise_signature(enum kernel_read_file_id id)
	1800	+{
	1801	+ struct ima_rule_entry *entry;
	1802	+ bool found = false;
	1803	+ enum ima_hooks func;
	1804	+
	1805	+ if (id >= READING_MAX_ID)
	1806	+ return false;
	1807	+
	1808	+ if (id == READING_KEXEC_IMAGE && !(ima_appraise & IMA_APPRAISE_ENFORCE)
	1809	+ && security_locked_down(LOCKDOWN_KEXEC))
	1810	+ return false;
	1811	+
	1812	+ func = read_idmap[id] ?: FILE_CHECK;
	1813	+
	1814	+ rcu_read_lock();
	1815	+ list_for_each_entry_rcu(entry, ima_rules, list) {
	1816	+ if (entry->action != APPRAISE)
	1817	+ continue;
	1818	+
	1819	+ /*
	1820	+ * A generic entry will match, but otherwise require that it
	1821	+ * match the func we're looking for
	1822	+ */
	1823	+ if (entry->func && entry->func != func)
	1824	+ continue;
	1825	+
	1826	+ /*
	1827	+ * We require this to be a digital signature, not a raw IMA
	1828	+ * hash.
	1829	+ */
	1830	+ if (entry->flags & IMA_DIGSIG_REQUIRED)
	1831	+ found = true;
	1832	+
	1833	+ /*
	1834	+ * We've found a rule that matches, so break now even if it
	1835	+ * didn't require a digital signature - a later rule that does
	1836	+ * won't override it, so would be a false positive.
	1837	+ */
	1838	+ break;
	1839	+ }
	1840	+
	1841	+ rcu_read_unlock();
	1842	+ return found;
	1843	+}
	1844	+#endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */