All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Christoph Hellwig <hch@infradead.org>,
	Luis Chamberlain <mcgrof@kernel.org>
Cc: viro@zeniv.linux.org.uk, gregkh@linuxfoundation.org,
	rafael@kernel.org, ebiederm@xmission.com, jeyu@kernel.org,
	jmorris@namei.org, keescook@chromium.org, paul@paul-moore.com,
	stephen.smalley.work@gmail.com, eparis@parisplace.org,
	nayna@linux.ibm.com, scott.branden@broadcom.com,
	dan.carpenter@oracle.com, skhan@linuxfoundation.org,
	geert@linux-m68k.org, tglx@linutronix.de, bauerman@linux.ibm.com,
	dhowells@redhat.com, linux-integrity@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, kexec@lists.infradead.org,
	linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/3] fs: reduce export usage of kerne_read*() calls
Date: Mon, 18 May 2020 08:37:42 -0400	[thread overview]
Message-ID: <1589805462.5111.107.camel@linux.ibm.com> (raw)
In-Reply-To: <20200518062255.GB15641@infradead.org>

Hi Christoph,

On Sun, 2020-05-17 at 23:22 -0700, Christoph Hellwig wrote:
> On Fri, May 15, 2020 at 09:29:33PM +0000, Luis Chamberlain wrote:
> > On Wed, May 13, 2020 at 11:17:36AM -0700, Christoph Hellwig wrote:
> > > Can you also move kernel_read_* out of fs.h?  That header gets pulled
> > > in just about everywhere and doesn't really need function not related
> > > to the general fs interface.
> > 
> > Sure, where should I dump these?
> 
> Maybe a new linux/kernel_read_file.h?  Bonus points for a small top
> of the file comment explaining the point of the interface, which I
> still don't get :)

Instead of rolling your own method of having the kernel read a file,
which requires call specific security hooks, this interface provides a
single generic set of pre and post security hooks.  The
kernel_read_file_id enumeration permits the security hook to
differentiate between callers.

To comply with secure and trusted boot concepts, a file cannot be
accessible to the caller until after it has been measured and/or the
integrity (hash/signature) appraised.

In some cases, the file was previously read twice, first to measure
and/or appraise the file and then read again into a buffer for
use.  This interface reads the file into a buffer once, calls the
generic post security hook, before providing the buffer to the caller.
 (Note using firmware pre-allocated memory might be an issue.)

Partial reading firmware will result in needing to pre-read the entire
file, most likely on the security pre hook.

Mimi

WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com>
To: Christoph Hellwig <hch@infradead.org>,
	Luis Chamberlain <mcgrof@kernel.org>
Cc: rafael@kernel.org, dhowells@redhat.com, paul@paul-moore.com,
	nayna@linux.ibm.com, jmorris@namei.org, geert@linux-m68k.org,
	dan.carpenter@oracle.com, keescook@chromium.org,
	scott.branden@broadcom.com, selinux@vger.kernel.org,
	viro@zeniv.linux.org.uk, skhan@linuxfoundation.org,
	eparis@parisplace.org, tglx@linutronix.de,
	gregkh@linuxfoundation.org, stephen.smalley.work@gmail.com,
	kexec@lists.infradead.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org, ebiederm@xmission.com,
	jeyu@kernel.org, linux-fsdevel@vger.kernel.org,
	linux-integrity@vger.kernel.org, bauerman@linux.ibm.com
Subject: Re: [PATCH 0/3] fs: reduce export usage of kerne_read*() calls
Date: Mon, 18 May 2020 08:37:42 -0400	[thread overview]
Message-ID: <1589805462.5111.107.camel@linux.ibm.com> (raw)
In-Reply-To: <20200518062255.GB15641@infradead.org>

Hi Christoph,

On Sun, 2020-05-17 at 23:22 -0700, Christoph Hellwig wrote:
> On Fri, May 15, 2020 at 09:29:33PM +0000, Luis Chamberlain wrote:
> > On Wed, May 13, 2020 at 11:17:36AM -0700, Christoph Hellwig wrote:
> > > Can you also move kernel_read_* out of fs.h?  That header gets pulled
> > > in just about everywhere and doesn't really need function not related
> > > to the general fs interface.
> > 
> > Sure, where should I dump these?
> 
> Maybe a new linux/kernel_read_file.h?  Bonus points for a small top
> of the file comment explaining the point of the interface, which I
> still don't get :)

Instead of rolling your own method of having the kernel read a file,
which requires call specific security hooks, this interface provides a
single generic set of pre and post security hooks.  The
kernel_read_file_id enumeration permits the security hook to
differentiate between callers.

To comply with secure and trusted boot concepts, a file cannot be
accessible to the caller until after it has been measured and/or the
integrity (hash/signature) appraised.

In some cases, the file was previously read twice, first to measure
and/or appraise the file and then read again into a buffer for
use.  This interface reads the file into a buffer once, calls the
generic post security hook, before providing the buffer to the caller.
 (Note using firmware pre-allocated memory might be an issue.)

Partial reading firmware will result in needing to pre-read the entire
file, most likely on the security pre hook.

Mimi

_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

  reply	other threads:[~2020-05-18 12:38 UTC|newest]

Thread overview: 44+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-13 15:21 [PATCH 0/3] fs: reduce export usage of kerne_read*() calls Luis Chamberlain
2020-05-13 15:21 ` Luis Chamberlain
2020-05-13 15:21 ` [PATCH 1/3] fs: unexport kernel_read_file() Luis Chamberlain
2020-05-13 15:21   ` Luis Chamberlain
2020-05-13 15:21 ` [PATCH 2/3] security: add symbol namespace for reading file data Luis Chamberlain
2020-05-13 15:21   ` Luis Chamberlain
2020-05-13 15:40   ` Eric W. Biederman
2020-05-13 15:40     ` Eric W. Biederman
2020-05-13 16:09     ` Greg KH
2020-05-13 16:09       ` Greg KH
2020-05-13 16:16     ` Luis Chamberlain
2020-05-13 16:16       ` Luis Chamberlain
2020-05-13 16:26       ` Greg KH
2020-05-13 16:26         ` Greg KH
2020-05-13 18:07       ` Josh Triplett
2020-05-13 18:07         ` Josh Triplett
2020-05-13 15:21 ` [PATCH 3/3] fs: move kernel_read*() calls to its own symbol namespace Luis Chamberlain
2020-05-13 15:21   ` Luis Chamberlain
2020-05-13 16:08   ` Greg KH
2020-05-13 16:08     ` Greg KH
2020-05-13 18:17 ` [PATCH 0/3] fs: reduce export usage of kerne_read*() calls Christoph Hellwig
2020-05-13 18:17   ` Christoph Hellwig
2020-05-15 21:29   ` Luis Chamberlain
2020-05-15 21:29     ` Luis Chamberlain
2020-05-18  6:22     ` Christoph Hellwig
2020-05-18  6:22       ` Christoph Hellwig
2020-05-18 12:37       ` Mimi Zohar [this message]
2020-05-18 12:37         ` Mimi Zohar
2020-05-18 15:21         ` Kees Cook
2020-05-18 15:21           ` Kees Cook
2020-07-29  1:20           ` Luis Chamberlain
2020-07-29  1:20             ` Luis Chamberlain
2020-05-22 22:24         ` Scott Branden
2020-05-22 22:24           ` Scott Branden
2020-05-22 23:04           ` Kees Cook
2020-05-22 23:04             ` Kees Cook
2020-05-22 23:25             ` Scott Branden
2020-05-22 23:25               ` Scott Branden
2020-05-24  2:52               ` Mimi Zohar
2020-05-24  2:52                 ` Mimi Zohar
2020-06-05 18:15                 ` Scott Branden
2020-06-05 18:15                   ` Scott Branden
2020-06-05 18:37                   ` Mimi Zohar
2020-06-05 18:37                     ` Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1589805462.5111.107.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=bauerman@linux.ibm.com \
    --cc=dan.carpenter@oracle.com \
    --cc=dhowells@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=eparis@parisplace.org \
    --cc=geert@linux-m68k.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hch@infradead.org \
    --cc=jeyu@kernel.org \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=kexec@lists.infradead.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mcgrof@kernel.org \
    --cc=nayna@linux.ibm.com \
    --cc=paul@paul-moore.com \
    --cc=rafael@kernel.org \
    --cc=scott.branden@broadcom.com \
    --cc=selinux@vger.kernel.org \
    --cc=skhan@linuxfoundation.org \
    --cc=stephen.smalley.work@gmail.com \
    --cc=tglx@linutronix.de \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.