[PATCH] ima: Avoid using not initialized IMA

[PATCH] ima: Avoid using not initialized IMA

[Petr Vorel]

IMA requires have it's hash algorithm to be compiled-in due it's early
use. Default IMA algorithm is protected by Kconfig to be compiled-in.

ima_hash kernel parameter allows to choose hash algorithm. When
specified algorithm not available or available as module, IMA
initialization fails, but mknodat syscall expect it and calls
ima_post_path_mknod(). This leads to to kernel oops:

$ grep CONFIG_CRYPTO_MD4 .config
CONFIG_CRYPTO_MD4=m

[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.12.14-2.3-default root=UUID=74ae8202-9ca7-4e39-813b-22287ec52f7a video=1024x768-16 plymouth.ignore-serial-consoles console=ttyS0 console=tty resume=/dev/disk/by-path/pci-0000:00:07.0-part3 splash=silent showopts ima_hash=md4
...
[    1.545190] ima: Can not allocate md4 (reason: -2)
...
[    2.610120] BUG: unable to handle kernel NULL pointer dereference at           (null)
[    2.611903] IP: ima_match_policy+0x23/0x390
[    2.612967] PGD 0 P4D 0
[    2.613080] Oops: 0000 [#1] SMP
[    2.613080] Modules linked in: autofs4
[    2.613080] Supported: Yes
[    2.613080] CPU: 0 PID: 1 Comm: systemd Not tainted 4.12.14-2.3-default #1
[    2.613080] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
[    2.613080] task: ffff88003e2d0040 task.stack: ffffc90000190000
[    2.613080] RIP: 0010:ima_match_policy+0x23/0x390
[    2.613080] RSP: 0018:ffffc90000193e88 EFLAGS: 00010296
[    2.613080] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000004
[    2.613080] RDX: 0000000000000010 RSI: 0000000000000001 RDI: ffff880037071728
[    2.613080] RBP: 0000000000008000 R08: 0000000000000000 R09: 0000000000000000
[    2.613080] R10: 0000000000000008 R11: 61c8864680b583eb R12: 00005580ff10086f
[    2.613080] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000008000
[    2.613080] FS:  00007f5c1da08940(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
[    2.613080] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.613080] CR2: 0000000000000000 CR3: 0000000037002000 CR4: 00000000003406f0
[    2.613080] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    2.613080] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    2.613080] Call Trace:
[    2.613080]  ? shmem_mknod+0xbf/0xd0
[    2.613080]  ima_post_path_mknod+0x1c/0x40
[    2.613080]  SyS_mknod+0x210/0x220
[    2.613080]  entry_SYSCALL_64_fastpath+0x1a/0xa5
[    2.613080] RIP: 0033:0x7f5c1bfde570
[    2.613080] RSP: 002b:00007ffde1c90dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000085
[    2.613080] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5c1bfde570
[    2.613080] RDX: 0000000000000000 RSI: 0000000000008000 RDI: 00005580ff10086f
[    2.613080] RBP: 00007ffde1c91040 R08: 00005580ff10086f R09: 0000000000000000
[    2.613080] R10: 0000000000104000 R11: 0000000000000246 R12: 00005580ffb99660
[    2.613080] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000002
[    2.613080] Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 57 41 56 44 8d 14 09 41 55 41 54 55 53 44 89 d3 09 cb 48 83 ec 38 48 8b 05 c5 03 29 01 <4c> 8b 20 4c 39 e0 0f 84 d7 01 00 00 4c 89 44 24 08 89 54 24 20
[    2.613080] RIP: ima_match_policy+0x23/0x390 RSP: ffffc90000193e88
[    2.613080] CR2: 0000000000000000
[    2.613080] ---[ end trace 9a9f0a8a73079f6a ]---
[    2.673052] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[    2.673052]
[    2.675337] Kernel Offset: disabled
[    2.676405] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 security/integrity/ima/ima_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 2cfb0c714967..503366805554 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -380,6 +380,9 @@ void ima_post_path_mknod(struct dentry *dentry)
 	struct inode *inode = dentry->d_inode;
 	int must_appraise;

+	if (!ima_initialized)
+		return;
+
 	must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
 	if (!must_appraise)
 		return;
--
2.12.3

Re: [PATCH] ima: Avoid using not initialized IMA

[Mimi Zohar]

On Sat, 2018-03-17 at 00:28 +0100, Petr Vorel wrote:
> IMA requires have it's hash algorithm to be compiled-in due it's early
> use. Default IMA algorithm is protected by Kconfig to be compiled-in.
> 
> ima_hash kernel parameter allows to choose hash algorithm. When
> specified algorithm not available or available as module, IMA
> initialization fails, but mknodat syscall expect it and calls
> ima_post_path_mknod(). This leads to to kernel oops:
> 
> $ grep CONFIG_CRYPTO_MD4 .config
> CONFIG_CRYPTO_MD4=m
> 
> [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.12.14-2.3-default root=UUID=74ae8202-9ca7-4e39-813b-22287ec52f7a video=1024x768-16 plymouth.ignore-serial-consoles console=ttyS0 console=tty resume=/dev/disk/by-path/pci-0000:00:07.0-part3 splash=silent showopts ima_hash=md4
> ...
> [    1.545190] ima: Can not allocate md4 (reason: -2)

The hash algorithm specified on the boot command line needs to be
builtin.  For whatever reason it isn't builtin, rather than skipping
measurements, a better solution I think would be to fallback to the
builtin hash algorithm.

Mimi

> ...
> [    2.610120] BUG: unable to handle kernel NULL pointer dereference at           (null)
> [    2.611903] IP: ima_match_policy+0x23/0x390
> [    2.612967] PGD 0 P4D 0
> [    2.613080] Oops: 0000 [#1] SMP
> [    2.613080] Modules linked in: autofs4
> [    2.613080] Supported: Yes
> [    2.613080] CPU: 0 PID: 1 Comm: systemd Not tainted 4.12.14-2.3-default #1
> [    2.613080] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
> [    2.613080] task: ffff88003e2d0040 task.stack: ffffc90000190000
> [    2.613080] RIP: 0010:ima_match_policy+0x23/0x390
> [    2.613080] RSP: 0018:ffffc90000193e88 EFLAGS: 00010296
> [    2.613080] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000004
> [    2.613080] RDX: 0000000000000010 RSI: 0000000000000001 RDI: ffff880037071728
> [    2.613080] RBP: 0000000000008000 R08: 0000000000000000 R09: 0000000000000000
> [    2.613080] R10: 0000000000000008 R11: 61c8864680b583eb R12: 00005580ff10086f
> [    2.613080] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000008000
> [    2.613080] FS:  00007f5c1da08940(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
> [    2.613080] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    2.613080] CR2: 0000000000000000 CR3: 0000000037002000 CR4: 00000000003406f0
> [    2.613080] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [    2.613080] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [    2.613080] Call Trace:
> [    2.613080]  ? shmem_mknod+0xbf/0xd0
> [    2.613080]  ima_post_path_mknod+0x1c/0x40
> [    2.613080]  SyS_mknod+0x210/0x220
> [    2.613080]  entry_SYSCALL_64_fastpath+0x1a/0xa5
> [    2.613080] RIP: 0033:0x7f5c1bfde570
> [    2.613080] RSP: 002b:00007ffde1c90dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000085
> [    2.613080] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5c1bfde570
> [    2.613080] RDX: 0000000000000000 RSI: 0000000000008000 RDI: 00005580ff10086f
> [    2.613080] RBP: 00007ffde1c91040 R08: 00005580ff10086f R09: 0000000000000000
> [    2.613080] R10: 0000000000104000 R11: 0000000000000246 R12: 00005580ffb99660
> [    2.613080] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000002
> [    2.613080] Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 57 41 56 44 8d 14 09 41 55 41 54 55 53 44 89 d3 09 cb 48 83 ec 38 48 8b 05 c5 03 29 01 <4c> 8b 20 4c 39 e0 0f 84 d7 01 00 00 4c 89 44 24 08 89 54 24 20
> [    2.613080] RIP: ima_match_policy+0x23/0x390 RSP: ffffc90000193e88
> [    2.613080] CR2: 0000000000000000
> [    2.613080] ---[ end trace 9a9f0a8a73079f6a ]---
> [    2.673052] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
> [    2.673052]
> [    2.675337] Kernel Offset: disabled
> [    2.676405] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
> 
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
> ---
>  security/integrity/ima/ima_main.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 2cfb0c714967..503366805554 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -380,6 +380,9 @@ void ima_post_path_mknod(struct dentry *dentry)
>  	struct inode *inode = dentry->d_inode;
>  	int must_appraise;
> 
> +	if (!ima_initialized)
> +		return;
> +
>  	must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
>  	if (!must_appraise)
>  		return;
> --
> 2.12.3
> 

Re: [PATCH] ima: Avoid using not initialized IMA

[James Morris]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: multipart/mixed; boundary="1665246916-1899361713-1521434628=:5791", Size: 1268 bytes --]

On Sat, 17 Mar 2018, Mimi Zohar wrote:

> On Sat, 2018-03-17 at 00:28 +0100, Petr Vorel wrote:
> > IMA requires have it's hash algorithm to be compiled-in due it's early
> > use. Default IMA algorithm is protected by Kconfig to be compiled-in.
> > 
> > ima_hash kernel parameter allows to choose hash algorithm. When
> > specified algorithm not available or available as module, IMA
> > initialization fails, but mknodat syscall expect it and calls
> > ima_post_path_mknod(). This leads to to kernel oops:
> > 
> > $ grep CONFIG_CRYPTO_MD4 .config
> > CONFIG_CRYPTO_MD4=m
> > 
> > [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.12.14-2.3-default root=UUID=74ae8202-9ca7-4e39-813b-22287ec52f7a video=1024x768-16 plymouth.ignore-serial-consoles console=ttyS0 console=tty resume=/dev/disk/by-path/pci-0000:00:07.0-part3 splash=silent showopts ima_hash=md4
> > ...
> > [    1.545190] ima: Can not allocate md4 (reason: -2)
> 
> The hash algorithm specified on the boot command line needs to be
> builtin.  For whatever reason it isn't builtin, rather than skipping
> measurements, a better solution I think would be to fallback to the
> builtin hash algorithm.

What if this falls back to a hash which is not secure enough?


-- 
James Morris
<jmorris@namei.org>

Re: [PATCH] ima: Avoid using not initialized IMA

[Mimi Zohar]

On Mon, 2018-03-19 at 15:43 +1100, James Morris wrote:
> On Sat, 17 Mar 2018, Mimi Zohar wrote:
> 
> > On Sat, 2018-03-17 at 00:28 +0100, Petr Vorel wrote:
> > > IMA requires have it's hash algorithm to be compiled-in due it's early
> > > use. Default IMA algorithm is protected by Kconfig to be compiled-in.
> > > 
> > > ima_hash kernel parameter allows to choose hash algorithm. When
> > > specified algorithm not available or available as module, IMA
> > > initialization fails, but mknodat syscall expect it and calls
> > > ima_post_path_mknod(). This leads to to kernel oops:
> > > 
> > > $ grep CONFIG_CRYPTO_MD4 .config
> > > CONFIG_CRYPTO_MD4=m
> > > 
> > > [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.12.14-2.3-default root=UUID=74ae8202-9ca7-4e39-813b-22287ec52f7a video=1024x768-16 plymouth.ignore-serial-consoles console=ttyS0 console=tty resume=/dev/disk/by-path/pci-0000:00:07.0-part3 splash=silent showopts ima_hash=md4
> > > ...
> > > [    1.545190] ima: Can not allocate md4 (reason: -2)
> > 
> > The hash algorithm specified on the boot command line needs to be
> > builtin.  For whatever reason it isn't builtin, rather than skipping
> > measurements, a better solution I think would be to fallback to the
> > builtin hash algorithm.
> 
> What if this falls back to a hash which is not secure enough?

It should fallback to the Kconfig selected hash algorithm as defined
in CONFIG_IMA_DEFAULT_HASH.

Mimi

Re: [PATCH] ima: Avoid using not initialized IMA

[Petr Vorel]

Hi Mimi,

> On Mon, 2018-03-19 at 15:43 +1100, James Morris wrote:
> > On Sat, 17 Mar 2018, Mimi Zohar wrote:

> > > On Sat, 2018-03-17 at 00:28 +0100, Petr Vorel wrote:
> > > > IMA requires have it's hash algorithm to be compiled-in due it's early
> > > > use. Default IMA algorithm is protected by Kconfig to be compiled-in.

> > > > ima_hash kernel parameter allows to choose hash algorithm. When
> > > > specified algorithm not available or available as module, IMA
> > > > initialization fails, but mknodat syscall expect it and calls
> > > > ima_post_path_mknod(). This leads to to kernel oops:

> > > > $ grep CONFIG_CRYPTO_MD4 .config
> > > > CONFIG_CRYPTO_MD4=m

> > > > [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.12.14-2.3-default root=UUID=74ae8202-9ca7-4e39-813b-22287ec52f7a video=1024x768-16 plymouth.ignore-serial-consoles console=ttyS0 console=tty resume=/dev/disk/by-path/pci-0000:00:07.0-part3 splash=silent showopts ima_hash=md4
> > > > ...
> > > > [    1.545190] ima: Can not allocate md4 (reason: -2)

> > > The hash algorithm specified on the boot command line needs to be
> > > builtin.  For whatever reason it isn't builtin, rather than skipping
> > > measurements, a better solution I think would be to fallback to the
> > > builtin hash algorithm.

> > What if this falls back to a hash which is not secure enough?

> It should fallback to the Kconfig selected hash algorithm as defined
> in CONFIG_IMA_DEFAULT_HASH.

OK, I have v2 which use CONFIG_IMA_DEFAULT_HASH, I'll post it tomorrow.
But I'd also keep this patch as well, this check doesn't harm and IMHO you can never be
sure it does not fail.

> Mimi

Kind regards,
Petr

Re: [PATCH] ima: Avoid using not initialized IMA

[Mimi Zohar]

On Mon, 2018-03-19 at 21:05 +0100, Petr Vorel wrote:
> Hi Mimi,
> 
> > On Mon, 2018-03-19 at 15:43 +1100, James Morris wrote:
> > > On Sat, 17 Mar 2018, Mimi Zohar wrote:
> 
> > > > On Sat, 2018-03-17 at 00:28 +0100, Petr Vorel wrote:
> > > > > IMA requires have it's hash algorithm to be compiled-in due it's early
> > > > > use. Default IMA algorithm is protected by Kconfig to be compiled-in.
> 
> > > > > ima_hash kernel parameter allows to choose hash algorithm. When
> > > > > specified algorithm not available or available as module, IMA
> > > > > initialization fails, but mknodat syscall expect it and calls
> > > > > ima_post_path_mknod(). This leads to to kernel oops:
> 
> > > > > $ grep CONFIG_CRYPTO_MD4 .config
> > > > > CONFIG_CRYPTO_MD4=m
> 
> > > > > [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.12.14-2.3-default root=UUID=74ae8202-9ca7-4e39-813b-22287ec52f7a video=1024x768-16 plymouth.ignore-serial-consoles console=ttyS0 console=tty resume=/dev/disk/by-path/pci-0000:00:07.0-part3 splash=silent showopts ima_hash=md4
> > > > > ...
> > > > > [    1.545190] ima: Can not allocate md4 (reason: -2)
> 
> > > > The hash algorithm specified on the boot command line needs to be
> > > > builtin.  For whatever reason it isn't builtin, rather than skipping
> > > > measurements, a better solution I think would be to fallback to the
> > > > builtin hash algorithm.
> 
> > > What if this falls back to a hash which is not secure enough?
> 
> > It should fallback to the Kconfig selected hash algorithm as defined
> > in CONFIG_IMA_DEFAULT_HASH.
> 
> OK, I have v2 which use CONFIG_IMA_DEFAULT_HASH, I'll post it tomorrow.
> But I'd also keep this patch as well, this check doesn't harm and IMHO you can never be
> sure it does not fail.

Adding a new measurement gap is not an acceptable solution.  Either an
ima_init() failure causes the kernel to panic, or we force IMA to use
the default builtin Kconfig hash algorithm.

Mimi

Re: [PATCH] ima: Avoid using not initialized IMA

[Petr Vorel]

Hi Mimi,

> > OK, I have v2 which use CONFIG_IMA_DEFAULT_HASH, I'll post it tomorrow.
> > But I'd also keep this patch as well, this check doesn't harm and IMHO you can never be
> > sure it does not fail.

> Adding a new measurement gap is not an acceptable solution.  Either an
> ima_init() failure causes the kernel to panic, or we force IMA to use
> the default builtin Kconfig hash algorithm.

Thank you for a clarification. I posted new patch which forces using default hash in case
of error and using different algorithm.

I don't know whether even this (third) attempt (to use default hash) can fail, but in case
it can, how do you prefer to handle this situation? If you really prefer kernel panic
(e.g. don't like previous patch fixing at least ima_post_path_mknod()), I suggest removing
ima_initialized as it's unused and confusing.

> Mimi


Kind regards,
Petr