From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:46978 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753012AbeBSPSX (ORCPT ); Mon, 19 Feb 2018 10:18:23 -0500 Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w1JFGTmV017164 for ; Mon, 19 Feb 2018 10:18:22 -0500 Received: from e06smtp12.uk.ibm.com (e06smtp12.uk.ibm.com [195.75.94.108]) by mx0a-001b2d01.pphosted.com with ESMTP id 2g80b22kay-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 19 Feb 2018 10:18:22 -0500 Received: from localhost by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 19 Feb 2018 15:18:20 -0000 From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Mimi Zohar , Miklos Szeredi , Seth Forshee , "Eric W . Biederman" , Dongsu Park , Alban Crequy , "Serge E . Hallyn" Subject: [PATCH v1 1/2] ima: fail signature verification on untrusted filesystems Date: Mon, 19 Feb 2018 10:18:02 -0500 In-Reply-To: <1519053483-18396-1-git-send-email-zohar@linux.vnet.ibm.com> References: <1519053483-18396-1-git-send-email-zohar@linux.vnet.ibm.com> Message-Id: <1519053483-18396-2-git-send-email-zohar@linux.vnet.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Files on untrusted filesystems, such as fuse, can change at any time, making the measurement(s) and by extension signature verification meaningless. FUSE can be mounted by unprivileged users either today with fusermount installed with setuid, or soon with the upcoming patches to allow FUSE mounts in a non-init user namespace. This patch differentiates between the new unprivileged non-init mounted filesystems and everything else, by always failing file signature verification on unprivileged non-init mounted untrusted filesystems, but only failing everything else based on policy to avoid breaking existing systems. This patch defines a new sb->s_iflags option named SB_I_IMA_UNTRUSTED_FS and a new builtin IMA policy named "untrusted_fs". Signed-off-by: Mimi Zohar Cc: Miklos Szeredi Cc: Seth Forshee Cc: Eric W. Biederman Cc: Dongsu Park Cc: Alban Crequy Cc: Serge E. Hallyn --- Changelog v1: - Merged the unprivileged and privileged patches. - Dropped IMA fsname support. - Introduced a new IMA builtin policy named "untrusted_fs". - Replaced fs_type flag with sb->s_iflags flag. Documentation/admin-guide/kernel-parameters.txt | 6 +++++- include/linux/fs.h | 1 + security/integrity/ima/ima_appraise.c | 16 +++++++++++++++- security/integrity/ima/ima_policy.c | 5 +++++ security/integrity/integrity.h | 1 + 5 files changed, 27 insertions(+), 2 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 90cefbddf1ed..f9eb24cea9a6 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1522,7 +1522,7 @@ ima_policy= [IMA] The builtin policies to load during IMA setup. - Format: "tcb | appraise_tcb | secure_boot" + Format: "tcb | appraise_tcb | secure_boot | untrusted_fs" The "tcb" policy measures all programs exec'd, files mmap'd for exec, and all files opened with the read @@ -1537,6 +1537,10 @@ of files (eg. kexec kernel image, kernel modules, firmware, policy, etc) based on file signatures. + The "untrusted_fs" policy fails the file signature + verification on privileged mounted untrusted + filesystems. + ima_tcb [IMA] Deprecated. Use ima_policy= instead. Load a policy which meets the needs of the Trusted Computing Base. This means IMA will measure all diff --git a/include/linux/fs.h b/include/linux/fs.h index 2a815560fda0..1d3fe0fe49ee 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1320,6 +1320,7 @@ extern int send_sigurg(struct fown_struct *fown); /* sb->s_iflags to limit user namespace mounts */ #define SB_I_USERNS_VISIBLE 0x00000010 /* fstype already mounted */ +#define SB_I_IMA_UNTRUSTED_FS 0x00000020 /* Kernel unaware of fs changes */ /* Possible states of 'frozen' field */ enum { diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index f2803a40ff82..ebfeec9b579f 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -292,7 +292,20 @@ int ima_appraise_measurement(enum ima_hooks func, } out: - if (status != INTEGRITY_PASS) { + /* + * Files on both privileged and unprivileged mounted untrusted + * filesystems (eg. FUSE) should fail signature verification, but + * this might break existing systems. Differentiate between the + * new unprivileged non-init mounted filesystems and everything else. + */ + if ((inode->i_sb->s_iflags & SB_I_IMA_UNTRUSTED_FS) && + ((inode->i_sb->s_user_ns != &init_user_ns) || + (iint->flags & IMA_FAIL_UNTRUSTED_FS))) { + status = INTEGRITY_FAIL; + cause = "untrusted-filesystem"; + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, + op, cause, rc, 0); + } else if (status != INTEGRITY_PASS) { if ((ima_appraise & IMA_APPRAISE_FIX) && (!xattr_value || xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { @@ -309,6 +322,7 @@ int ima_appraise_measurement(enum ima_hooks func, } else { ima_cache_flags(iint, func); } + ima_set_cache_status(iint, func, status); return status; } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 915f5572c6ff..43fb05b9686d 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -188,6 +188,7 @@ __setup("ima_tcb", default_measure_policy_setup); static bool ima_use_appraise_tcb __initdata; static bool ima_use_secure_boot __initdata; +static bool ima_fail_untrusted_fs __initdata; static int __init policy_setup(char *str) { char *p; @@ -201,6 +202,8 @@ static int __init policy_setup(char *str) ima_use_appraise_tcb = true; else if (strcmp(p, "secure_boot") == 0) ima_use_secure_boot = true; + else if (strcmp(p, "untrusted_fs") == 0) + ima_fail_untrusted_fs = true; } return 1; @@ -385,6 +388,8 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, if (entry->action & IMA_APPRAISE) { action |= get_subaction(entry, func); action ^= IMA_HASH; + if (ima_fail_untrusted_fs) + action |= IMA_FAIL_UNTRUSTED_FS; } if (entry->action & IMA_DO_MASK) diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 50a8e3365df7..f8fa60f560a6 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -35,6 +35,7 @@ #define IMA_PERMIT_DIRECTIO 0x02000000 #define IMA_NEW_FILE 0x04000000 #define EVM_IMMUTABLE_DIGSIG 0x08000000 +#define IMA_FAIL_UNTRUSTED_FS 0x10000000 #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ IMA_HASH | IMA_APPRAISE_SUBMASK) -- 2.7.5 From mboxrd@z Thu Jan 1 00:00:00 1970 From: zohar@linux.vnet.ibm.com (Mimi Zohar) Date: Mon, 19 Feb 2018 10:18:02 -0500 Subject: [PATCH v1 1/2] ima: fail signature verification on untrusted filesystems In-Reply-To: <1519053483-18396-1-git-send-email-zohar@linux.vnet.ibm.com> References: <1519053483-18396-1-git-send-email-zohar@linux.vnet.ibm.com> Message-ID: <1519053483-18396-2-git-send-email-zohar@linux.vnet.ibm.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org Files on untrusted filesystems, such as fuse, can change at any time, making the measurement(s) and by extension signature verification meaningless. FUSE can be mounted by unprivileged users either today with fusermount installed with setuid, or soon with the upcoming patches to allow FUSE mounts in a non-init user namespace. This patch differentiates between the new unprivileged non-init mounted filesystems and everything else, by always failing file signature verification on unprivileged non-init mounted untrusted filesystems, but only failing everything else based on policy to avoid breaking existing systems. This patch defines a new sb->s_iflags option named SB_I_IMA_UNTRUSTED_FS and a new builtin IMA policy named "untrusted_fs". Signed-off-by: Mimi Zohar Cc: Miklos Szeredi Cc: Seth Forshee Cc: Eric W. Biederman Cc: Dongsu Park Cc: Alban Crequy Cc: Serge E. Hallyn --- Changelog v1: - Merged the unprivileged and privileged patches. - Dropped IMA fsname support. - Introduced a new IMA builtin policy named "untrusted_fs". - Replaced fs_type flag with sb->s_iflags flag. Documentation/admin-guide/kernel-parameters.txt | 6 +++++- include/linux/fs.h | 1 + security/integrity/ima/ima_appraise.c | 16 +++++++++++++++- security/integrity/ima/ima_policy.c | 5 +++++ security/integrity/integrity.h | 1 + 5 files changed, 27 insertions(+), 2 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 90cefbddf1ed..f9eb24cea9a6 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1522,7 +1522,7 @@ ima_policy= [IMA] The builtin policies to load during IMA setup. - Format: "tcb | appraise_tcb | secure_boot" + Format: "tcb | appraise_tcb | secure_boot | untrusted_fs" The "tcb" policy measures all programs exec'd, files mmap'd for exec, and all files opened with the read @@ -1537,6 +1537,10 @@ of files (eg. kexec kernel image, kernel modules, firmware, policy, etc) based on file signatures. + The "untrusted_fs" policy fails the file signature + verification on privileged mounted untrusted + filesystems. + ima_tcb [IMA] Deprecated. Use ima_policy= instead. Load a policy which meets the needs of the Trusted Computing Base. This means IMA will measure all diff --git a/include/linux/fs.h b/include/linux/fs.h index 2a815560fda0..1d3fe0fe49ee 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1320,6 +1320,7 @@ extern int send_sigurg(struct fown_struct *fown); /* sb->s_iflags to limit user namespace mounts */ #define SB_I_USERNS_VISIBLE 0x00000010 /* fstype already mounted */ +#define SB_I_IMA_UNTRUSTED_FS 0x00000020 /* Kernel unaware of fs changes */ /* Possible states of 'frozen' field */ enum { diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index f2803a40ff82..ebfeec9b579f 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -292,7 +292,20 @@ int ima_appraise_measurement(enum ima_hooks func, } out: - if (status != INTEGRITY_PASS) { + /* + * Files on both privileged and unprivileged mounted untrusted + * filesystems (eg. FUSE) should fail signature verification, but + * this might break existing systems. Differentiate between the + * new unprivileged non-init mounted filesystems and everything else. + */ + if ((inode->i_sb->s_iflags & SB_I_IMA_UNTRUSTED_FS) && + ((inode->i_sb->s_user_ns != &init_user_ns) || + (iint->flags & IMA_FAIL_UNTRUSTED_FS))) { + status = INTEGRITY_FAIL; + cause = "untrusted-filesystem"; + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, + op, cause, rc, 0); + } else if (status != INTEGRITY_PASS) { if ((ima_appraise & IMA_APPRAISE_FIX) && (!xattr_value || xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { @@ -309,6 +322,7 @@ int ima_appraise_measurement(enum ima_hooks func, } else { ima_cache_flags(iint, func); } + ima_set_cache_status(iint, func, status); return status; } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 915f5572c6ff..43fb05b9686d 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -188,6 +188,7 @@ __setup("ima_tcb", default_measure_policy_setup); static bool ima_use_appraise_tcb __initdata; static bool ima_use_secure_boot __initdata; +static bool ima_fail_untrusted_fs __initdata; static int __init policy_setup(char *str) { char *p; @@ -201,6 +202,8 @@ static int __init policy_setup(char *str) ima_use_appraise_tcb = true; else if (strcmp(p, "secure_boot") == 0) ima_use_secure_boot = true; + else if (strcmp(p, "untrusted_fs") == 0) + ima_fail_untrusted_fs = true; } return 1; @@ -385,6 +388,8 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, if (entry->action & IMA_APPRAISE) { action |= get_subaction(entry, func); action ^= IMA_HASH; + if (ima_fail_untrusted_fs) + action |= IMA_FAIL_UNTRUSTED_FS; } if (entry->action & IMA_DO_MASK) diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 50a8e3365df7..f8fa60f560a6 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -35,6 +35,7 @@ #define IMA_PERMIT_DIRECTIO 0x02000000 #define IMA_NEW_FILE 0x04000000 #define EVM_IMMUTABLE_DIGSIG 0x08000000 +#define IMA_FAIL_UNTRUSTED_FS 0x10000000 #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ IMA_HASH | IMA_APPRAISE_SUBMASK) -- 2.7.5 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html