All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: David Howells <dhowells@redhat.com>
Cc: Matthew Garrett <mjg59@google.com>,
	Mimi Zohar <zohar@linux.vnet.ibm.com>,
	linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	Eric Biederman <ebiederm@xmission.com>,
	kexec@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/3] ima: based on the "secure_boot" policy limit syscalls
Date: Thu, 12 Apr 2018 18:41:49 -0400	[thread overview]
Message-ID: <1523572911-16363-2-git-send-email-zohar@linux.vnet.ibm.com> (raw)
In-Reply-To: <1523572911-16363-1-git-send-email-zohar@linux.vnet.ibm.com>

The builtin "secure_boot" policy adds IMA appraisal rules requiring kernel
modules (finit_module syscall), direct firmware load, kexec kernel image
(kexec_file_load syscall), and the IMA policy to be signed, but did not
prevent the other syscalls/methods from working.  Loading an equivalent
custom policy containing these same rules would have prevented the other
syscalls/methods from working.

This patch refactors the code to load custom policies, defining a new
function named ima_appraise_flag().  The new function is called either
when loading the builtin "secure_boot" or custom policies.

Fixes: 503ceaef8e2e ("ima: define a set of appraisal rules requiring file signatures")
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
---
 security/integrity/ima/ima_policy.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index d89bebf85421..1bdb5bc57568 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -435,6 +435,17 @@ void ima_update_policy_flag(void)
 		ima_policy_flag &= ~IMA_APPRAISE;
 }
 
+static int ima_appraise_flag(enum ima_hooks func)
+{
+	if (func == MODULE_CHECK)
+		return IMA_APPRAISE_MODULES;
+	else if (func == FIRMWARE_CHECK)
+		return IMA_APPRAISE_FIRMWARE;
+	else if (func == POLICY_CHECK)
+		return IMA_APPRAISE_POLICY;
+	return 0;
+}
+
 /**
  * ima_init_policy - initialize the default measure rules.
  *
@@ -473,9 +484,12 @@ void __init ima_init_policy(void)
 	 * Insert the appraise rules requiring file signatures, prior to
 	 * any other appraise rules.
 	 */
-	for (i = 0; i < secure_boot_entries; i++)
+	for (i = 0; i < secure_boot_entries; i++) {
 		list_add_tail(&secure_boot_rules[i].list,
 			      &ima_default_rules);
+		temp_ima_appraise |=
+		    ima_appraise_flag(secure_boot_rules[i].func);
+	}
 
 	for (i = 0; i < appraise_entries; i++) {
 		list_add_tail(&default_appraise_rules[i].list,
@@ -917,12 +931,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 	}
 	if (!result && (entry->action == UNKNOWN))
 		result = -EINVAL;
-	else if (entry->func == MODULE_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_MODULES;
-	else if (entry->func == FIRMWARE_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
-	else if (entry->func == POLICY_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_POLICY;
+	else if (entry->action == APPRAISE)
+		temp_ima_appraise |= ima_appraise_flag(entry->func);
+
 	audit_log_format(ab, "res=%d", !result);
 	audit_log_end(ab);
 	return result;
-- 
2.7.5

WARNING: multiple messages have this Message-ID
From: zohar@linux.vnet.ibm.com (Mimi Zohar)
To: linux-security-module@vger.kernel.org
Subject: [PATCH 1/3] ima: based on the "secure_boot" policy limit syscalls
Date: Thu, 12 Apr 2018 18:41:49 -0400	[thread overview]
Message-ID: <1523572911-16363-2-git-send-email-zohar@linux.vnet.ibm.com> (raw)
In-Reply-To: <1523572911-16363-1-git-send-email-zohar@linux.vnet.ibm.com>

The builtin "secure_boot" policy adds IMA appraisal rules requiring kernel
modules (finit_module syscall), direct firmware load, kexec kernel image
(kexec_file_load syscall), and the IMA policy to be signed, but did not
prevent the other syscalls/methods from working.  Loading an equivalent
custom policy containing these same rules would have prevented the other
syscalls/methods from working.

This patch refactors the code to load custom policies, defining a new
function named ima_appraise_flag().  The new function is called either
when loading the builtin "secure_boot" or custom policies.

Fixes: 503ceaef8e2e ("ima: define a set of appraisal rules requiring file signatures")
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
---
 security/integrity/ima/ima_policy.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index d89bebf85421..1bdb5bc57568 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -435,6 +435,17 @@ void ima_update_policy_flag(void)
 		ima_policy_flag &= ~IMA_APPRAISE;
 }
 
+static int ima_appraise_flag(enum ima_hooks func)
+{
+	if (func == MODULE_CHECK)
+		return IMA_APPRAISE_MODULES;
+	else if (func == FIRMWARE_CHECK)
+		return IMA_APPRAISE_FIRMWARE;
+	else if (func == POLICY_CHECK)
+		return IMA_APPRAISE_POLICY;
+	return 0;
+}
+
 /**
  * ima_init_policy - initialize the default measure rules.
  *
@@ -473,9 +484,12 @@ void __init ima_init_policy(void)
 	 * Insert the appraise rules requiring file signatures, prior to
 	 * any other appraise rules.
 	 */
-	for (i = 0; i < secure_boot_entries; i++)
+	for (i = 0; i < secure_boot_entries; i++) {
 		list_add_tail(&secure_boot_rules[i].list,
 			      &ima_default_rules);
+		temp_ima_appraise |=
+		    ima_appraise_flag(secure_boot_rules[i].func);
+	}
 
 	for (i = 0; i < appraise_entries; i++) {
 		list_add_tail(&default_appraise_rules[i].list,
@@ -917,12 +931,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 	}
 	if (!result && (entry->action == UNKNOWN))
 		result = -EINVAL;
-	else if (entry->func == MODULE_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_MODULES;
-	else if (entry->func == FIRMWARE_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
-	else if (entry->func == POLICY_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_POLICY;
+	else if (entry->action == APPRAISE)
+		temp_ima_appraise |= ima_appraise_flag(entry->func);
+
 	audit_log_format(ab, "res=%d", !result);
 	audit_log_end(ab);
 	return result;
-- 
2.7.5

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

WARNING: multiple messages have this Message-ID
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: David Howells <dhowells@redhat.com>
Cc: kexec@lists.infradead.org, linux-kernel@vger.kernel.org,
	Matthew Garrett <mjg59@google.com>,
	linux-security-module@vger.kernel.org,
	Eric Biederman <ebiederm@xmission.com>,
	linux-integrity@vger.kernel.org,
	Mimi Zohar <zohar@linux.vnet.ibm.com>
Subject: [PATCH 1/3] ima: based on the "secure_boot" policy limit syscalls
Date: Thu, 12 Apr 2018 18:41:49 -0400	[thread overview]
Message-ID: <1523572911-16363-2-git-send-email-zohar@linux.vnet.ibm.com> (raw)
In-Reply-To: <1523572911-16363-1-git-send-email-zohar@linux.vnet.ibm.com>

The builtin "secure_boot" policy adds IMA appraisal rules requiring kernel
modules (finit_module syscall), direct firmware load, kexec kernel image
(kexec_file_load syscall), and the IMA policy to be signed, but did not
prevent the other syscalls/methods from working.  Loading an equivalent
custom policy containing these same rules would have prevented the other
syscalls/methods from working.

This patch refactors the code to load custom policies, defining a new
function named ima_appraise_flag().  The new function is called either
when loading the builtin "secure_boot" or custom policies.

Fixes: 503ceaef8e2e ("ima: define a set of appraisal rules requiring file signatures")
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
---
 security/integrity/ima/ima_policy.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index d89bebf85421..1bdb5bc57568 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -435,6 +435,17 @@ void ima_update_policy_flag(void)
 		ima_policy_flag &= ~IMA_APPRAISE;
 }
 
+static int ima_appraise_flag(enum ima_hooks func)
+{
+	if (func == MODULE_CHECK)
+		return IMA_APPRAISE_MODULES;
+	else if (func == FIRMWARE_CHECK)
+		return IMA_APPRAISE_FIRMWARE;
+	else if (func == POLICY_CHECK)
+		return IMA_APPRAISE_POLICY;
+	return 0;
+}
+
 /**
  * ima_init_policy - initialize the default measure rules.
  *
@@ -473,9 +484,12 @@ void __init ima_init_policy(void)
 	 * Insert the appraise rules requiring file signatures, prior to
 	 * any other appraise rules.
 	 */
-	for (i = 0; i < secure_boot_entries; i++)
+	for (i = 0; i < secure_boot_entries; i++) {
 		list_add_tail(&secure_boot_rules[i].list,
 			      &ima_default_rules);
+		temp_ima_appraise |=
+		    ima_appraise_flag(secure_boot_rules[i].func);
+	}
 
 	for (i = 0; i < appraise_entries; i++) {
 		list_add_tail(&default_appraise_rules[i].list,
@@ -917,12 +931,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 	}
 	if (!result && (entry->action == UNKNOWN))
 		result = -EINVAL;
-	else if (entry->func == MODULE_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_MODULES;
-	else if (entry->func == FIRMWARE_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
-	else if (entry->func == POLICY_CHECK)
-		temp_ima_appraise |= IMA_APPRAISE_POLICY;
+	else if (entry->action == APPRAISE)
+		temp_ima_appraise |= ima_appraise_flag(entry->func);
+
 	audit_log_format(ab, "res=%d", !result);
 	audit_log_end(ab);
 	return result;
-- 
2.7.5


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

  reply	other threads:[~2018-04-12 22:42 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-12 22:41 [PATCH 0/3] kexec: limit kexec_load syscall Mimi Zohar
2018-04-12 22:41 ` Mimi Zohar
2018-04-12 22:41 ` Mimi Zohar
2018-04-12 22:41 ` Mimi Zohar [this message]
2018-04-12 22:41   ` [PATCH 1/3] ima: based on the "secure_boot" policy limit syscalls Mimi Zohar
2018-04-12 22:41   ` Mimi Zohar
2018-04-12 22:41 ` [PATCH 2/3] kexec: call LSM hook for kexec_load syscall Mimi Zohar
2018-04-12 22:41   ` Mimi Zohar
2018-04-12 22:41   ` Mimi Zohar
2018-05-02 13:33   ` Mimi Zohar
2018-05-02 13:33     ` Mimi Zohar
2018-05-02 14:45   ` Eric W. Biederman
2018-05-02 14:45     ` Eric W. Biederman
2018-05-02 14:45     ` Eric W. Biederman
2018-05-02 15:45     ` Mimi Zohar
2018-05-02 15:45       ` Mimi Zohar
2018-05-02 15:45       ` Mimi Zohar
2018-05-02 15:45       ` Mimi Zohar
2018-05-03 15:51       ` Eric W. Biederman
2018-05-03 15:51         ` Eric W. Biederman
2018-05-03 15:51         ` Eric W. Biederman
2018-05-03 15:51         ` Eric W. Biederman
2018-05-03 16:05         ` Casey Schaufler
2018-05-03 16:05           ` Casey Schaufler
2018-05-03 16:05           ` Casey Schaufler
2018-05-03 16:05           ` Casey Schaufler
2018-05-03 16:42           ` Eric W. Biederman
2018-05-03 16:42             ` Eric W. Biederman
2018-05-03 16:42             ` Eric W. Biederman
2018-05-03 16:42             ` Eric W. Biederman
2018-05-03 21:06             ` Mimi Zohar
2018-05-03 21:06               ` Mimi Zohar
2018-05-03 21:06               ` Mimi Zohar
2018-05-03 21:06               ` Mimi Zohar
2018-05-03 21:36               ` Eric W. Biederman
2018-05-03 21:36                 ` Eric W. Biederman
2018-05-03 21:36                 ` Eric W. Biederman
2018-05-03 21:36                 ` Eric W. Biederman
2018-04-12 22:41 ` [PATCH 3/3] ima: based on policy require signed kexec kernel images Mimi Zohar
2018-04-12 22:41   ` Mimi Zohar
2018-04-12 22:41   ` Mimi Zohar
2018-05-03 20:13 ` [PATCH 0/3] kexec: limit kexec_load syscall Eric W. Biederman
2018-05-03 20:13   ` Eric W. Biederman
2018-05-03 20:13   ` Eric W. Biederman
2018-05-03 20:39   ` Matthew Garrett
2018-05-03 20:39     ` Matthew Garrett
2018-05-03 20:39     ` Matthew Garrett
2018-05-03 21:58     ` Eric W. Biederman
2018-05-03 21:58       ` Eric W. Biederman
2018-05-03 21:58       ` Eric W. Biederman
2018-05-03 22:51       ` Matthew Garrett
2018-05-03 22:51         ` Matthew Garrett
2018-05-03 22:51         ` Matthew Garrett
2018-05-03 21:31   ` Mimi Zohar
2018-05-03 21:31     ` Mimi Zohar
2018-05-03 21:31     ` Mimi Zohar
2018-05-03 21:31     ` Mimi Zohar
2018-05-03 21:38     ` Eric W. Biederman
2018-05-03 21:38       ` Eric W. Biederman
2018-05-03 21:38       ` Eric W. Biederman
2018-05-03 21:38       ` Eric W. Biederman
2018-05-03 21:57       ` Mimi Zohar
2018-05-03 21:57         ` Mimi Zohar
2018-05-03 21:57         ` Mimi Zohar
2018-05-03 21:57         ` Mimi Zohar
2018-05-03 23:03         ` Eric W. Biederman
2018-05-03 23:03           ` Eric W. Biederman
2018-05-03 23:03           ` Eric W. Biederman
2018-05-03 23:03           ` Eric W. Biederman
2018-05-04  2:29           ` Mimi Zohar
2018-05-04  2:29             ` Mimi Zohar
2018-05-04  2:29             ` Mimi Zohar
2018-05-04  2:29             ` Mimi Zohar
2018-05-11  1:36 Mimi Zohar
2018-05-11  1:36 ` [PATCH 1/3] ima: based on the "secure_boot" policy limit syscalls Mimi Zohar
2018-05-11  1:36   ` Mimi Zohar
2018-05-11  1:36   ` Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1523572911-16363-2-git-send-email-zohar@linux.vnet.ibm.com \
    --to=zohar@linux.vnet.ibm.com \
    --cc=dhowells@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=kexec@lists.infradead.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mjg59@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.