linux/security/ipe/audit.c

// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
 */

#include <linux/slab.h>
#include <linux/audit.h>
#include <linux/types.h>
#include <crypto/sha2.h>

#include "ipe.h"
#include "eval.h"
#include "hooks.h"
#include "policy.h"
#include "audit.h"
#include "digest.h"

#define ACTSTR(x) ((x) == IPE_ACTION_ALLOW ? "ALLOW" : "DENY")

#define IPE_AUDIT_HASH_ALG "sha256" /* keep in sync with audit_policy() */

#define AUDIT_POLICY_LOAD_FMT "policy_name=\"%s\" policy_version=%hu.%hu.%hu "\
			      "policy_digest=" IPE_AUDIT_HASH_ALG ":"
#define AUDIT_POLICY_LOAD_NULL_FMT "policy_name=? policy_version=? "\
				   "policy_digest=?"
#define AUDIT_OLD_ACTIVE_POLICY_FMT "old_active_pol_name=\"%s\" "\
				    "old_active_pol_version=%hu.%hu.%hu "\
				    "old_policy_digest=" IPE_AUDIT_HASH_ALG ":"
#define AUDIT_OLD_ACTIVE_POLICY_NULL_FMT "old_active_pol_name=? "\
					 "old_active_pol_version=? "\
					 "old_policy_digest=?"
#define AUDIT_NEW_ACTIVE_POLICY_FMT "new_active_pol_name=\"%s\" "\
				    "new_active_pol_version=%hu.%hu.%hu "\
				    "new_policy_digest=" IPE_AUDIT_HASH_ALG ":"

static const char *const audit_op_names[__IPE_OP_MAX + 1] = {
	[IPE_OP_EXEC]			= "EXECUTE",
	[IPE_OP_FIRMWARE]		= "FIRMWARE",
	[IPE_OP_KERNEL_MODULE]		= "KMODULE",
	[IPE_OP_KEXEC_IMAGE]		= "KEXEC_IMAGE",
	[IPE_OP_KEXEC_INITRAMFS]	= "KEXEC_INITRAMFS",
	[IPE_OP_POLICY]			= "POLICY",
	[IPE_OP_X509]			= "X509_CERT",
	[IPE_OP_INVALID]		= "UNKNOWN",
};

static const char *const audit_hook_names[__IPE_HOOK_MAX] = {
	[IPE_HOOK_BPRM_CHECK]		= "BPRM_CHECK",
	[IPE_HOOK_BPRM_CREDS_FOR_EXEC]	= "BPRM_CREDS_FOR_EXEC",
	[IPE_HOOK_MMAP]			= "MMAP",
	[IPE_HOOK_MPROTECT]		= "MPROTECT",
	[IPE_HOOK_KERNEL_READ]		= "KERNEL_READ",
	[IPE_HOOK_KERNEL_LOAD]		= "KERNEL_LOAD",
};

static const char *const audit_prop_names[__IPE_PROP_MAX] = {
	[IPE_PROP_BOOT_VERIFIED_FALSE]	= "boot_verified=FALSE",
	[IPE_PROP_BOOT_VERIFIED_TRUE]	= "boot_verified=TRUE",
	[IPE_PROP_DMV_ROOTHASH]		= "dmverity_roothash=",
	[IPE_PROP_DMV_SIG_FALSE]	= "dmverity_signature=FALSE",
	[IPE_PROP_DMV_SIG_TRUE]		= "dmverity_signature=TRUE",
	[IPE_PROP_FSV_DIGEST]		= "fsverity_digest=",
	[IPE_PROP_FSV_SIG_FALSE]	= "fsverity_signature=FALSE",
	[IPE_PROP_FSV_SIG_TRUE]		= "fsverity_signature=TRUE",
};

/**
 * audit_dmv_roothash() - audit the roothash of a dmverity_roothash property.
 * @ab: Supplies a pointer to the audit_buffer to append to.
 * @rh: Supplies a pointer to the digest structure.
 */
static void audit_dmv_roothash(struct audit_buffer *ab, const void *rh)
{
	audit_log_format(ab, "%s", audit_prop_names[IPE_PROP_DMV_ROOTHASH]);
	ipe_digest_audit(ab, rh);
}

/**
 * audit_fsv_digest() - audit the digest of a fsverity_digest property.
 * @ab: Supplies a pointer to the audit_buffer to append to.
 * @d: Supplies a pointer to the digest structure.
 */
static void audit_fsv_digest(struct audit_buffer *ab, const void *d)
{
	audit_log_format(ab, "%s", audit_prop_names[IPE_PROP_FSV_DIGEST]);
	ipe_digest_audit(ab, d);
}

/**
 * audit_rule() - audit an IPE policy rule.
 * @ab: Supplies a pointer to the audit_buffer to append to.
 * @r: Supplies a pointer to the ipe_rule to approximate a string form for.
 */
static void audit_rule(struct audit_buffer *ab, const struct ipe_rule *r)
{
	const struct ipe_prop *ptr;

	audit_log_format(ab, " rule=\"op=%s ", audit_op_names[r->op]);

	list_for_each_entry(ptr, &r->props, next) {
		switch (ptr->type) {
		case IPE_PROP_DMV_ROOTHASH:
			audit_dmv_roothash(ab, ptr->value);
			break;
		case IPE_PROP_FSV_DIGEST:
			audit_fsv_digest(ab, ptr->value);
			break;
		default:
			audit_log_format(ab, "%s", audit_prop_names[ptr->type]);
			break;
		}

		audit_log_format(ab, " ");
	}

	audit_log_format(ab, "action=%s\"", ACTSTR(r->action));
}

/**
 * ipe_audit_match() - Audit a rule match in a policy evaluation.
 * @ctx: Supplies a pointer to the evaluation context that was used in the
 *	 evaluation.
 * @match_type: Supplies the scope of the match: rule, operation default,
 *		global default.
 * @act: Supplies the IPE's evaluation decision, deny or allow.
 * @r: Supplies a pointer to the rule that was matched, if possible.
 */
void ipe_audit_match(const struct ipe_eval_ctx *const ctx,
		     enum ipe_match match_type,
		     enum ipe_action_type act, const struct ipe_rule *const r)
{
	const char *op = audit_op_names[ctx->op];
	char comm[sizeof(current->comm)];
	struct audit_buffer *ab;
	struct inode *inode;

	if (act != IPE_ACTION_DENY && !READ_ONCE(success_audit))
		return;

	ab = audit_log_start(audit_context(), GFP_ATOMIC | __GFP_NOWARN,
			     AUDIT_IPE_ACCESS);
	if (!ab)
		return;

	audit_log_format(ab, "ipe_op=%s ipe_hook=%s enforcing=%d pid=%d comm=",
			 op, audit_hook_names[ctx->hook], READ_ONCE(enforce),
			 task_tgid_nr(current));
	audit_log_untrustedstring(ab, get_task_comm(comm, current));

	if (ctx->file) {
		audit_log_d_path(ab, " path=", &ctx->file->f_path);
		inode = file_inode(ctx->file);
		if (inode) {
			audit_log_format(ab, " dev=");
			audit_log_untrustedstring(ab, inode->i_sb->s_id);
			audit_log_format(ab, " ino=%llu", inode->i_ino);
		} else {
			audit_log_format(ab, " dev=? ino=?");
		}
	} else {
		audit_log_format(ab, " path=? dev=? ino=?");
	}

	if (match_type == IPE_MATCH_RULE)
		audit_rule(ab, r);
	else if (match_type == IPE_MATCH_TABLE)
		audit_log_format(ab, " rule=\"DEFAULT op=%s action=%s\"", op,
				 ACTSTR(act));
	else
		audit_log_format(ab, " rule=\"DEFAULT action=%s\"",
				 ACTSTR(act));

	audit_log_end(ab);
}

/**
 * audit_policy() - Audit a policy's name, version and thumbprint to @ab.
 * @ab: Supplies a pointer to the audit buffer to append to.
 * @audit_format: Supplies a pointer to the audit format string
 * @p: Supplies a pointer to the policy to audit.
 */
static void audit_policy(struct audit_buffer *ab,
			 const char *audit_format,
			 const struct ipe_policy *const p)
{
	u8 digest[SHA256_DIGEST_SIZE];

	sha256(p->pkcs7, p->pkcs7len, digest);

	audit_log_format(ab, audit_format, p->parsed->name,
			 p->parsed->version.major, p->parsed->version.minor,
			 p->parsed->version.rev);
	audit_log_n_hex(ab, digest, sizeof(digest));
}

/**
 * ipe_audit_policy_activation() - Audit a policy being activated.
 * @op: Supplies a pointer to the previously activated policy to audit.
 * @np: Supplies a pointer to the newly activated policy to audit.
 */
void ipe_audit_policy_activation(const struct ipe_policy *const op,
				 const struct ipe_policy *const np)
{
	struct audit_buffer *ab;

	ab = audit_log_start(audit_context(), GFP_KERNEL,
			     AUDIT_IPE_CONFIG_CHANGE);
	if (!ab)
		return;

	if (op) {
		audit_policy(ab, AUDIT_OLD_ACTIVE_POLICY_FMT, op);
		audit_log_format(ab, " ");
	} else {
		/*
		 * old active policy can be NULL if there is no kernel
		 * built-in policy
		 */
		audit_log_format(ab, AUDIT_OLD_ACTIVE_POLICY_NULL_FMT);
		audit_log_format(ab, " ");
	}
	audit_policy(ab, AUDIT_NEW_ACTIVE_POLICY_FMT, np);
	audit_log_format(ab, " auid=%u ses=%u lsm=ipe res=1",
			 from_kuid(&init_user_ns, audit_get_loginuid(current)),
			 audit_get_sessionid(current));

	audit_log_end(ab);
}

/**
 * ipe_audit_policy_load() - Audit a policy loading event.
 * @p: Supplies a pointer to the policy to audit or an error pointer.
 */
void ipe_audit_policy_load(const struct ipe_policy *const p)
{
	struct audit_buffer *ab;
	int err = 0;

	ab = audit_log_start(audit_context(), GFP_KERNEL,
			     AUDIT_IPE_POLICY_LOAD);
	if (!ab)
		return;

	if (!IS_ERR(p)) {
		audit_policy(ab, AUDIT_POLICY_LOAD_FMT, p);
	} else {
		audit_log_format(ab, AUDIT_POLICY_LOAD_NULL_FMT);
		err = PTR_ERR(p);
	}

	audit_log_format(ab, " auid=%u ses=%u lsm=ipe res=%d errno=%d",
			 from_kuid(&init_user_ns, audit_get_loginuid(current)),
			 audit_get_sessionid(current), !err, err);

	audit_log_end(ab);
}

/**
 * ipe_audit_enforce() - Audit a change in IPE's enforcement state.
 * @new_enforce: The new value enforce to be set.
 * @old_enforce: The old value currently in enforce.
 */
void ipe_audit_enforce(bool new_enforce, bool old_enforce)
{
	audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
		  "enforcing=%d old_enforcing=%d auid=%u ses=%u"
		  " enabled=1 old-enabled=1 lsm=ipe res=1",
		  new_enforce, old_enforce,
		  from_kuid(&init_user_ns, audit_get_loginuid(current)),
		  audit_get_sessionid(current));
}