[CRYPTO] users: Use crypto_hash interface instead of crypto_digest
[linux-2.6.git] / security / seclvl.c
1 /**
2  * BSD Secure Levels LSM
3  *
4  * Maintainers:
5  *      Michael A. Halcrow <mike@halcrow.us>
6  *      Serge Hallyn <hallyn@cs.wm.edu>
7  *
8  * Copyright (c) 2001 WireX Communications, Inc <chris@wirex.com>
9  * Copyright (c) 2001 Greg Kroah-Hartman <greg@kroah.com>
10  * Copyright (c) 2002 International Business Machines <robb@austin.ibm.com>
11  * Copyright (c) 2006 Davi E. M. Arnaut <davi.arnaut@gmail.com>
12  *
13  *      This program is free software; you can redistribute it and/or modify
14  *      it under the terms of the GNU General Public License as published by
15  *      the Free Software Foundation; either version 2 of the License, or
16  *      (at your option) any later version.
17  */
18
19 #include <linux/err.h>
20 #include <linux/module.h>
21 #include <linux/moduleparam.h>
22 #include <linux/kernel.h>
23 #include <linux/init.h>
24 #include <linux/security.h>
25 #include <linux/netlink.h>
26 #include <linux/fs.h>
27 #include <linux/namei.h>
28 #include <linux/mount.h>
29 #include <linux/capability.h>
30 #include <linux/time.h>
31 #include <linux/proc_fs.h>
32 #include <linux/kobject.h>
33 #include <linux/crypto.h>
34 #include <asm/scatterlist.h>
35 #include <linux/scatterlist.h>
36 #include <linux/gfp.h>
37 #include <linux/sysfs.h>
38
39 #define SHA1_DIGEST_SIZE 20
40
41 /**
42  * Module parameter that defines the initial secure level.
43  *
44  * When built as a module, it defaults to seclvl 1, which is the
45  * behavior of BSD secure levels.  Note that this default behavior
46  * wrecks havoc on a machine when the seclvl module is compiled into
47  * the kernel.  In that case, we default to seclvl 0.
48  */
49 #ifdef CONFIG_SECURITY_SECLVL_MODULE
50 static int initlvl = 1;
51 #else
52 static int initlvl;
53 #endif
54 module_param(initlvl, int, 0);
55 MODULE_PARM_DESC(initlvl, "Initial secure level (defaults to 1)");
56
57 /* Module parameter that defines the verbosity level */
58 static int verbosity;
59 module_param(verbosity, int, 0);
60 MODULE_PARM_DESC(verbosity, "Initial verbosity level (0 or 1; defaults to "
61                  "0, which is Quiet)");
62
63 /**
64  * Optional password which can be passed in to bring seclvl to 0
65  * (i.e., for halt/reboot).  Defaults to NULL (the passwd attribute
66  * file will not be registered in sysfs).
67  *
68  * This gets converted to its SHA1 hash when stored.  It's probably
69  * not a good idea to use this parameter when loading seclvl from a
70  * script; use sha1_passwd instead.
71  */
72
73 #define MAX_PASSWD_SIZE 32
74 static char passwd[MAX_PASSWD_SIZE];
75 module_param_string(passwd, passwd, sizeof(passwd), 0);
76 MODULE_PARM_DESC(passwd,
77                  "Plaintext of password that sets seclvl=0 when written to "
78                  "(sysfs mount point)/seclvl/passwd\n");
79
80 /**
81  * SHA1 hashed version of the optional password which can be passed in
82  * to bring seclvl to 0 (i.e., for halt/reboot).  Must be in
83  * hexadecimal format (40 characters).  Defaults to NULL (the passwd
84  * attribute file will not be registered in sysfs).
85  *
86  * Use the sha1sum utility to generate the SHA1 hash of a password:
87  *
88  * echo -n "secret" | sha1sum
89  */
90 #define MAX_SHA1_PASSWD 41
91 static char sha1_passwd[MAX_SHA1_PASSWD];
92 module_param_string(sha1_passwd, sha1_passwd, sizeof(sha1_passwd), 0);
93 MODULE_PARM_DESC(sha1_passwd,
94                  "SHA1 hash (40 hexadecimal characters) of password that "
95                  "sets seclvl=0 when plaintext password is written to "
96                  "(sysfs mount point)/seclvl/passwd\n");
97
98 static int hideHash = 1;
99 module_param(hideHash, int, 0);
100 MODULE_PARM_DESC(hideHash, "When set to 0, reading seclvl/passwd from sysfs "
101                  "will return the SHA1-hashed value of the password that "
102                  "lowers the secure level to 0.\n");
103
104 #define MY_NAME "seclvl"
105
106 /**
107  * This time-limits log writes to one per second.
108  */
109 #define seclvl_printk(verb, type, fmt, arg...)                  \
110         do {                                                    \
111                 if (verbosity >= verb) {                        \
112                         static unsigned long _prior;            \
113                         unsigned long _now = jiffies;           \
114                         if ((_now - _prior) > HZ) {             \
115                                 printk(type "%s: %s: " fmt,     \
116                                         MY_NAME, __FUNCTION__ , \
117                                         ## arg);                \
118                                 _prior = _now;                  \
119                         }                                       \
120                 }                                               \
121         } while (0)
122
123 /**
124  * The actual security level.  Ranges between -1 and 2 inclusive.
125  */
126 static int seclvl;
127
128 /**
129  * flag to keep track of how we were registered
130  */
131 static int secondary;
132
133 /**
134  * Verifies that the requested secure level is valid, given the current
135  * secure level.
136  */
137 static int seclvl_sanity(int reqlvl)
138 {
139         if ((reqlvl < -1) || (reqlvl > 2)) {
140                 seclvl_printk(1, KERN_WARNING, "Attempt to set seclvl out of "
141                               "range: [%d]\n", reqlvl);
142                 return -EINVAL;
143         }
144         if ((seclvl == 0) && (reqlvl == -1))
145                 return 0;
146         if (reqlvl < seclvl) {
147                 seclvl_printk(1, KERN_WARNING, "Attempt to lower seclvl to "
148                               "[%d]\n", reqlvl);
149                 return -EPERM;
150         }
151         return 0;
152 }
153
154 /**
155  * security level advancement rules:
156  *   Valid levels are -1 through 2, inclusive.
157  *   From -1, stuck.  [ in case compiled into kernel ]
158  *   From 0 or above, can only increment.
159  */
160 static void do_seclvl_advance(void *data, u64 val)
161 {
162         int ret;
163         int newlvl = (int)val;
164
165         ret = seclvl_sanity(newlvl);
166         if (ret)
167                 return;
168
169         if (newlvl > 2) {
170                 seclvl_printk(1, KERN_WARNING, "Cannot advance to seclvl "
171                               "[%d]\n", newlvl);
172                 return;
173         }
174         if (seclvl == -1) {
175                 seclvl_printk(1, KERN_WARNING, "Not allowed to advance to "
176                               "seclvl [%d]\n", seclvl);
177                 return;
178         }
179         seclvl = newlvl;  /* would it be more "correct" to set *data? */
180         return;
181 }
182
183 static u64 seclvl_int_get(void *data)
184 {
185         return *(int *)data;
186 }
187
188 DEFINE_SIMPLE_ATTRIBUTE(seclvl_file_ops, seclvl_int_get, do_seclvl_advance, "%lld\n");
189
190 static unsigned char hashedPassword[SHA1_DIGEST_SIZE];
191
192 /**
193  * Converts a block of plaintext of into its SHA1 hashed value.
194  *
195  * It would be nice if crypto had a wrapper to do this for us linear
196  * people...
197  */
198 static int
199 plaintext_to_sha1(unsigned char *hash, const char *plaintext, unsigned int len)
200 {
201         struct hash_desc desc;
202         struct scatterlist sg;
203         int err;
204
205         if (len > PAGE_SIZE) {
206                 seclvl_printk(0, KERN_ERR, "Plaintext password too large (%d "
207                               "characters).  Largest possible is %lu "
208                               "bytes.\n", len, PAGE_SIZE);
209                 return -EINVAL;
210         }
211         desc.tfm = crypto_alloc_hash("sha1", 0, CRYPTO_ALG_ASYNC);
212         if (IS_ERR(desc.tfm)) {
213                 seclvl_printk(0, KERN_ERR,
214                               "Failed to load transform for SHA1\n");
215                 return -EINVAL;
216         }
217         sg_init_one(&sg, (u8 *)plaintext, len);
218         desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
219         err = crypto_hash_digest(&desc, &sg, len, hash);
220         crypto_free_hash(desc.tfm);
221         return err;
222 }
223
224 /**
225  * Called whenever the user writes to the sysfs passwd handle to this kernel
226  * object.  It hashes the password and compares the hashed results.
227  */
228 static ssize_t
229 passwd_write_file(struct file * file, const char __user * buf,
230                                 size_t count, loff_t *ppos)
231 {
232         char *p;
233         int len;
234         unsigned char tmp[SHA1_DIGEST_SIZE];
235
236         if (!*passwd && !*sha1_passwd) {
237                 seclvl_printk(0, KERN_ERR, "Attempt to password-unlock the "
238                               "seclvl module, but neither a plain text "
239                               "password nor a SHA1 hashed password was "
240                               "passed in as a module parameter!  This is a "
241                               "bug, since it should not be possible to be in "
242                               "this part of the module; please tell a "
243                               "maintainer about this event.\n");
244                 return -EINVAL;
245         }
246
247         if (count >= PAGE_SIZE)
248                 return -EINVAL;
249         if (*ppos != 0)
250                 return -EINVAL;
251         p = kmalloc(count, GFP_KERNEL);
252         if (!p)
253                 return -ENOMEM;
254         len = -EFAULT;
255         if (copy_from_user(p, buf, count))
256                 goto out;
257         
258         len = count;
259         /* ``echo "secret" > seclvl/passwd'' includes a newline */
260         if (p[len - 1] == '\n')
261                 len--;
262         /* Hash the password, then compare the hashed values */
263         if ((len = plaintext_to_sha1(tmp, p, len))) {
264                 seclvl_printk(0, KERN_ERR, "Error hashing password: rc = "
265                               "[%d]\n", len);
266                 goto out;
267         }
268
269         len = -EPERM;
270         if (memcmp(hashedPassword, tmp, SHA1_DIGEST_SIZE))
271                 goto out;
272
273         seclvl_printk(0, KERN_INFO,
274                       "Password accepted; seclvl reduced to 0.\n");
275         seclvl = 0;
276         len = count;
277
278 out:
279         kfree (p);
280         return len;
281 }
282
283 static struct file_operations passwd_file_ops = {
284         .write = passwd_write_file,
285 };
286
287 /**
288  * Explicitely disallow ptrace'ing the init process.
289  */
290 static int seclvl_ptrace(struct task_struct *parent, struct task_struct *child)
291 {
292         if (seclvl >= 0 && child->pid == 1) {
293                 seclvl_printk(1, KERN_WARNING, "Attempt to ptrace "
294                               "the init process dissallowed in "
295                               "secure level %d\n", seclvl);
296                 return -EPERM;
297         }
298         return 0;
299 }
300
301 /**
302  * Capability checks for seclvl.  The majority of the policy
303  * enforcement for seclvl takes place here.
304  */
305 static int seclvl_capable(struct task_struct *tsk, int cap)
306 {
307         int rc = 0;
308
309         /* init can do anything it wants */
310         if (tsk->pid == 1)
311                 return 0;
312
313         if (seclvl > 0) {
314                 rc = -EPERM;
315
316                 if (cap == CAP_LINUX_IMMUTABLE)
317                         seclvl_printk(1, KERN_WARNING, "Attempt to modify "
318                                       "the IMMUTABLE and/or APPEND extended "
319                                       "attribute on a file with the IMMUTABLE "
320                                       "and/or APPEND extended attribute set "
321                                       "denied in seclvl [%d]\n", seclvl);
322                 else if (cap == CAP_SYS_RAWIO)
323                         seclvl_printk(1, KERN_WARNING, "Attempt to perform "
324                                       "raw I/O while in secure level [%d] "
325                                       "denied\n", seclvl);
326                 else if (cap == CAP_NET_ADMIN)
327                         seclvl_printk(1, KERN_WARNING, "Attempt to perform "
328                                       "network administrative task while "
329                                       "in secure level [%d] denied\n", seclvl);
330                 else if (cap == CAP_SETUID)
331                         seclvl_printk(1, KERN_WARNING, "Attempt to setuid "
332                                       "while in secure level [%d] denied\n",
333                                       seclvl);
334                 else if (cap == CAP_SETGID)
335                         seclvl_printk(1, KERN_WARNING, "Attempt to setgid "
336                                       "while in secure level [%d] denied\n",
337                                       seclvl);
338                 else if (cap == CAP_SYS_MODULE)
339                         seclvl_printk(1, KERN_WARNING, "Attempt to perform "
340                                       "a module operation while in secure "
341                                       "level [%d] denied\n", seclvl);
342                 else
343                         rc = 0;
344         }
345
346         if (!rc) {
347                 if (!(cap_is_fs_cap(cap) ? tsk->fsuid == 0 : tsk->euid == 0))
348                         rc = -EPERM;
349         }
350
351         if (rc)
352                 seclvl_printk(1, KERN_WARNING, "Capability denied\n");
353
354         return rc;
355 }
356
357 /**
358  * Disallow reversing the clock in seclvl > 1
359  */
360 static int seclvl_settime(struct timespec *tv, struct timezone *tz)
361 {
362         if (tv && seclvl > 1) {
363                 struct timespec now;
364                 now = current_kernel_time();
365                 if (tv->tv_sec < now.tv_sec ||
366                     (tv->tv_sec == now.tv_sec && tv->tv_nsec < now.tv_nsec)) {
367                         seclvl_printk(1, KERN_WARNING, "Attempt to decrement "
368                                       "time in secure level %d denied: "
369                                       "current->pid = [%d], "
370                                       "current->group_leader->pid = [%d]\n",
371                                       seclvl, current->pid,
372                                       current->group_leader->pid);
373                         return -EPERM;
374                 }               /* if attempt to decrement time */
375         }                       /* if seclvl > 1 */
376         return 0;
377 }
378
379 /* claim the blockdev to exclude mounters, release on file close */
380 static int seclvl_bd_claim(struct inode *inode)
381 {
382         int holder;
383         struct block_device *bdev = NULL;
384         dev_t dev = inode->i_rdev;
385         bdev = open_by_devnum(dev, FMODE_WRITE);
386         if (bdev) {
387                 if (bd_claim(bdev, &holder)) {
388                         blkdev_put(bdev);
389                         return -EPERM;
390                 }
391                 /* claimed, mark it to release on close */
392                 inode->i_security = current;
393         }
394         return 0;
395 }
396
397 /* release the blockdev if you claimed it */
398 static void seclvl_bd_release(struct inode *inode)
399 {
400         if (inode && S_ISBLK(inode->i_mode) && inode->i_security == current) {
401                 struct block_device *bdev = inode->i_bdev;
402                 if (bdev) {
403                         bd_release(bdev);
404                         blkdev_put(bdev);
405                         inode->i_security = NULL;
406                 }
407         }
408 }
409
410 /**
411  * Security for writes to block devices is regulated by this seclvl
412  * function.  Deny all writes to block devices in seclvl 2.  In
413  * seclvl 1, we only deny writes to *mounted* block devices.
414  */
415 static int
416 seclvl_inode_permission(struct inode *inode, int mask, struct nameidata *nd)
417 {
418         if (current->pid != 1 && S_ISBLK(inode->i_mode) && (mask & MAY_WRITE)) {
419                 switch (seclvl) {
420                 case 2:
421                         seclvl_printk(1, KERN_WARNING, "Write to block device "
422                                       "denied in secure level [%d]\n", seclvl);
423                         return -EPERM;
424                 case 1:
425                         if (seclvl_bd_claim(inode)) {
426                                 seclvl_printk(1, KERN_WARNING,
427                                               "Write to mounted block device "
428                                               "denied in secure level [%d]\n",
429                                               seclvl);
430                                 return -EPERM;
431                         }
432                 }
433         }
434         return 0;
435 }
436
437 /**
438  * The SUID and SGID bits cannot be set in seclvl >= 1
439  */
440 static int seclvl_inode_setattr(struct dentry *dentry, struct iattr *iattr)
441 {
442         if (seclvl > 0) {
443                 if (iattr->ia_valid & ATTR_MODE)
444                         if (iattr->ia_mode & S_ISUID ||
445                             iattr->ia_mode & S_ISGID) {
446                                 seclvl_printk(1, KERN_WARNING, "Attempt to "
447                                               "modify SUID or SGID bit "
448                                               "denied in seclvl [%d]\n",
449                                               seclvl);
450                                 return -EPERM;
451                         }
452         }
453         return 0;
454 }
455
456 /* release busied block devices */
457 static void seclvl_file_free_security(struct file *filp)
458 {
459         struct dentry *dentry = filp->f_dentry;
460
461         if (dentry)
462                 seclvl_bd_release(dentry->d_inode);
463 }
464
465 /**
466  * Cannot unmount in secure level 2
467  */
468 static int seclvl_umount(struct vfsmount *mnt, int flags)
469 {
470         if (current->pid != 1 && seclvl == 2) {
471                 seclvl_printk(1, KERN_WARNING, "Attempt to unmount in secure "
472                               "level %d\n", seclvl);
473                 return -EPERM;
474         }
475         return 0;
476 }
477
478 static struct security_operations seclvl_ops = {
479         .ptrace = seclvl_ptrace,
480         .capable = seclvl_capable,
481         .inode_permission = seclvl_inode_permission,
482         .inode_setattr = seclvl_inode_setattr,
483         .file_free_security = seclvl_file_free_security,
484         .settime = seclvl_settime,
485         .sb_umount = seclvl_umount,
486 };
487
488 /**
489  * Process the password-related module parameters
490  */
491 static int processPassword(void)
492 {
493         int rc = 0;
494         if (*passwd) {
495                 char *p;
496
497                 if (*sha1_passwd) {
498                         seclvl_printk(0, KERN_ERR, "Error: Both "
499                                       "passwd and sha1_passwd "
500                                       "were set, but they are mutually "
501                                       "exclusive.\n");
502                         return -EINVAL;
503                 }
504
505                 p = kstrdup(passwd, GFP_KERNEL);
506                 if (p == NULL)
507                         return -ENOMEM;
508
509                 if ((rc = plaintext_to_sha1(hashedPassword, p, strlen(p))))
510                         seclvl_printk(0, KERN_ERR, "Error: SHA1 support not "
511                                       "in kernel\n");
512
513                 kfree (p);
514                 /* All static data goes to the BSS, which zero's the
515                  * plaintext password out for us. */
516         } else if (*sha1_passwd) {      // Base 16
517                 int i;
518                 i = strlen(sha1_passwd);
519                 if (i != (SHA1_DIGEST_SIZE * 2)) {
520                         seclvl_printk(0, KERN_ERR, "Received [%d] bytes; "
521                                       "expected [%d] for the hexadecimal "
522                                       "representation of the SHA1 hash of "
523                                       "the password.\n",
524                                       i, (SHA1_DIGEST_SIZE * 2));
525                         return -EINVAL;
526                 }
527                 while ((i -= 2) + 2) {
528                         unsigned char tmp;
529                         tmp = sha1_passwd[i + 2];
530                         sha1_passwd[i + 2] = '\0';
531                         hashedPassword[i / 2] = (unsigned char)
532                             simple_strtol(&sha1_passwd[i], NULL, 16);
533                         sha1_passwd[i + 2] = tmp;
534                 }
535         }
536         return rc;
537 }
538
539 /**
540  * securityfs registrations
541  */
542 struct dentry *dir_ino, *seclvl_ino, *passwd_ino;
543
544 static int seclvlfs_register(void)
545 {
546         int rc = 0;
547
548         dir_ino = securityfs_create_dir("seclvl", NULL);
549
550         if (IS_ERR(dir_ino))
551                 return PTR_ERR(dir_ino);
552
553         seclvl_ino = securityfs_create_file("seclvl", S_IRUGO | S_IWUSR,
554                                 dir_ino, &seclvl, &seclvl_file_ops);
555         if (IS_ERR(seclvl_ino)) {
556                 rc = PTR_ERR(seclvl_ino);
557                 goto out_deldir;
558         }
559         if (*passwd || *sha1_passwd) {
560                 passwd_ino = securityfs_create_file("passwd", S_IRUGO | S_IWUSR,
561                                 dir_ino, NULL, &passwd_file_ops);
562                 if (IS_ERR(passwd_ino)) {
563                         rc = PTR_ERR(passwd_ino);
564                         goto out_delf;
565                 }
566         }
567         return rc;
568
569 out_delf:
570         securityfs_remove(seclvl_ino);
571
572 out_deldir:
573         securityfs_remove(dir_ino);
574
575         return rc;
576 }
577
578 static void seclvlfs_unregister(void)
579 {
580         securityfs_remove(seclvl_ino);
581
582         if (*passwd || *sha1_passwd)
583                 securityfs_remove(passwd_ino);
584
585         securityfs_remove(dir_ino);
586 }
587
588 /**
589  * Initialize the seclvl module.
590  */
591 static int __init seclvl_init(void)
592 {
593         int rc = 0;
594         static char once;
595
596         if (verbosity < 0 || verbosity > 1) {
597                 printk(KERN_ERR "Error: bad verbosity [%d]; only 0 or 1 "
598                        "are valid values\n", verbosity);
599                 rc = -EINVAL;
600                 goto exit;
601         }
602         if (initlvl < -1 || initlvl > 2) {
603                 seclvl_printk(0, KERN_ERR, "Error: bad initial securelevel "
604                               "[%d].\n", initlvl);
605                 rc = -EINVAL;
606                 goto exit;
607         }
608         seclvl = initlvl;
609         if ((rc = processPassword())) {
610                 seclvl_printk(0, KERN_ERR, "Error processing the password "
611                               "module parameter(s): rc = [%d]\n", rc);
612                 goto exit;
613         }
614
615         if ((rc = seclvlfs_register())) {
616                 seclvl_printk(0, KERN_ERR, "Error registering with sysfs\n");
617                 goto exit;
618         }
619         /* register ourselves with the security framework */
620         if (register_security(&seclvl_ops)) {
621                 seclvl_printk(0, KERN_ERR,
622                               "seclvl: Failure registering with the "
623                               "kernel.\n");
624                 /* try registering with primary module */
625                 rc = mod_reg_security(MY_NAME, &seclvl_ops);
626                 if (rc) {
627                         seclvl_printk(0, KERN_ERR, "seclvl: Failure "
628                                       "registering with primary security "
629                                       "module.\n");
630                         seclvlfs_unregister();
631                         goto exit;
632                 }               /* if primary module registered */
633                 secondary = 1;
634         }                       /* if we registered ourselves with the security framework */
635
636         seclvl_printk(0, KERN_INFO, "seclvl: Successfully initialized.\n");
637
638         if (once) {
639                 once = 1;
640                 seclvl_printk(0, KERN_INFO, "seclvl is going away. It has been "
641                                 "buggy for ages. Also, be warned that "
642                                 "Securelevels are useless.");
643         }
644  exit:
645         if (rc)
646                 printk(KERN_ERR "seclvl: Error during initialization: rc = "
647                        "[%d]\n", rc);
648         return rc;
649 }
650
651 /**
652  * Remove the seclvl module.
653  */
654 static void __exit seclvl_exit(void)
655 {
656         seclvlfs_unregister();
657
658         if (secondary)
659                 mod_unreg_security(MY_NAME, &seclvl_ops);
660         else if (unregister_security(&seclvl_ops))
661                 seclvl_printk(0, KERN_INFO,
662                               "seclvl: Failure unregistering with the "
663                               "kernel\n");
664 }
665
666 module_init(seclvl_init);
667 module_exit(seclvl_exit);
668
669 MODULE_AUTHOR("Michael A. Halcrow <mike@halcrow.us>");
670 MODULE_DESCRIPTION("LSM implementation of the BSD Secure Levels");
671 MODULE_LICENSE("GPL");