From: Stefan Berger <stefanb@linux.ibm.com>
To: linux-integrity@vger.kernel.org
Cc: zohar@linux.ibm.com, serge@hallyn.com, brauner@kernel.org,
containers@lists.linux.dev, dmitry.kasatkin@gmail.com,
ebiederm@xmission.com, krzysztof.struczynski@huawei.com,
roberto.sassu@huawei.com, mpeters@redhat.com, lhinds@redhat.com,
lsturman@redhat.com, puiterwi@redhat.com, jejb@linux.ibm.com,
jamjoom@us.ibm.com, linux-kernel@vger.kernel.org,
paul@paul-moore.com, rgb@redhat.com,
linux-security-module@vger.kernel.org, jmorris@namei.org,
jpenumak@redhat.com, Stefan Berger <stefanb@linux.ibm.com>
Subject: [PATCH v15 12/26] ima: Only accept AUDIT rules for non-init_ima_ns namespaces for now
Date: Mon, 6 Feb 2023 09:02:39 -0500 [thread overview]
Message-ID: <20230206140253.3755945-13-stefanb@linux.ibm.com> (raw)
In-Reply-To: <20230206140253.3755945-1-stefanb@linux.ibm.com>
For non-init_ima_ns namespaces, only accept AUDIT rules for now. Reject
all rules that require support for measuring, appraisal, and hashing.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Acked-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
v9:
- Jump to err_audit when unsupported rules are detected
---
security/integrity/ima/ima_policy.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 19aca18db323..2a2c88f7d135 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -1912,6 +1912,17 @@ static int ima_parse_rule(struct ima_namespace *ns,
result = -EINVAL;
break;
}
+
+ /* IMA namespace only accepts AUDIT rules */
+ if (ns != &init_ima_ns && result == 0) {
+ switch (entry->action) {
+ case MEASURE:
+ case APPRAISE:
+ case HASH:
+ result = -EINVAL;
+ goto err_audit;
+ }
+ }
}
if (!result && !ima_validate_rule(entry))
result = -EINVAL;
@@ -1933,6 +1944,7 @@ static int ima_parse_rule(struct ima_namespace *ns,
"verity rules should include d-ngv2");
}
+err_audit:
audit_log_format(ab, "res=%d", !result);
audit_log_end(ab);
return result;
--
2.37.3
next prev parent reply other threads:[~2023-02-06 14:03 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-06 14:02 [PATCH v15 00/26] ima: Namespace IMA with audit support in IMA-ns Stefan Berger
2023-02-06 14:02 ` [PATCH v15 01/26] securityfs: rework dentry creation Stefan Berger
2023-02-10 0:39 ` Jarkko Sakkinen
2023-02-06 14:02 ` [PATCH v15 02/26] securityfs: Extend securityfs with namespacing support Stefan Berger
2023-02-06 14:02 ` [PATCH v15 03/26] ima: Define ima_namespace struct and start moving variables into it Stefan Berger
2023-02-06 14:02 ` [PATCH v15 04/26] ima: Move arch_policy_entry into ima_namespace Stefan Berger
2023-02-06 14:02 ` [PATCH v15 05/26] ima: Move ima_htable " Stefan Berger
2023-02-06 14:02 ` [PATCH v15 06/26] ima: Move measurement list related variables " Stefan Berger
2023-02-06 14:02 ` [PATCH v15 07/26] ima: Move some IMA policy and filesystem " Stefan Berger
2023-02-06 14:02 ` [PATCH v15 08/26] ima: Move IMA securityfs files into ima_namespace or onto stack Stefan Berger
2023-02-06 14:02 ` [PATCH v15 09/26] ima: Move ima_lsm_policy_notifier into ima_namespace Stefan Berger
2023-02-06 14:02 ` [PATCH v15 10/26] ima: Switch to lazy lsm policy updates for better performance Stefan Berger
2023-02-06 14:02 ` [PATCH v15 11/26] ima: Define mac_admin_ns_capable() as a wrapper for ns_capable() Stefan Berger
2023-02-06 14:02 ` Stefan Berger [this message]
2023-02-06 14:02 ` [PATCH v15 13/26] userns: Add pointer to ima_namespace to user_namespace Stefan Berger
2023-02-06 14:02 ` [PATCH v15 14/26] ima: Implement hierarchical processing of file accesses Stefan Berger
2023-02-06 14:02 ` [PATCH v15 15/26] ima: Implement ima_free_policy_rules() for freeing of an ima_namespace Stefan Berger
2023-02-06 14:02 ` [PATCH v15 16/26] ima: Add functions for creating and " Stefan Berger
2023-02-06 14:02 ` [PATCH v15 17/26] integrity/ima: Define ns_status for storing namespaced iint data Stefan Berger
2023-02-06 14:02 ` [PATCH v15 18/26] integrity: Add optional callback function to integrity_inode_free() Stefan Berger
2023-02-06 14:02 ` [PATCH v15 19/26] ima: Namespace audit status flags Stefan Berger
2023-02-06 14:02 ` [PATCH v15 20/26] ima: Remove unused iints from the integrity_iint_cache Stefan Berger
2023-02-06 14:02 ` [PATCH v15 21/26] ima: Setup securityfs for IMA namespace Stefan Berger
2023-02-06 14:02 ` [PATCH v15 22/26] ima: Introduce securityfs file to activate an " Stefan Berger
2023-02-06 14:02 ` [PATCH v15 23/26] ima: Show owning user namespace's uid and gid when displaying policy Stefan Berger
2023-02-06 14:02 ` [PATCH v15 24/26] ima: Limit number of policy rules in non-init_ima_ns Stefan Berger
2023-02-06 14:02 ` [PATCH v15 25/26] ima: Restrict informational audit messages to init_ima_ns Stefan Berger
2023-02-06 14:02 ` [PATCH v15 26/26] ima: Enable IMA namespaces Stefan Berger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230206140253.3755945-13-stefanb@linux.ibm.com \
--to=stefanb@linux.ibm.com \
--cc=brauner@kernel.org \
--cc=containers@lists.linux.dev \
--cc=dmitry.kasatkin@gmail.com \
--cc=ebiederm@xmission.com \
--cc=jamjoom@us.ibm.com \
--cc=jejb@linux.ibm.com \
--cc=jmorris@namei.org \
--cc=jpenumak@redhat.com \
--cc=krzysztof.struczynski@huawei.com \
--cc=lhinds@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=lsturman@redhat.com \
--cc=mpeters@redhat.com \
--cc=paul@paul-moore.com \
--cc=puiterwi@redhat.com \
--cc=rgb@redhat.com \
--cc=roberto.sassu@huawei.com \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.