[PATCH] ima: Reflect correct permissions for policy

[PATCH] ima: Reflect correct permissions for policy

[Petr Vorel]

Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n
keeps 0600 mode after loading policy. Remove write permission to state
that policy file no longer be written.

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 security/integrity/ima/ima_fs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index fa540c0469da..c1265127d1b6 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file)
 	ima_policy = NULL;
 #elif defined(CONFIG_IMA_WRITE_POLICY)
 	clear_bit(IMA_FS_BUSY, &ima_fs_flags);
+#elif defined(CONFIG_IMA_READ_POLICY)
+	inode->i_mode &= ~S_IWUSR;
 #endif
 	return 0;
 }
-- 
2.12.3

Re: [PATCH] ima: Reflect correct permissions for policy

[Mimi Zohar]

On Fri, 2018-04-20 at 15:28 +0200, Petr Vorel wrote:
> Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n
> keeps 0600 mode after loading policy. Remove write permission to state
> that policy file no longer be written.
> 
> Signed-off-by: Petr Vorel <pvorel@suse.cz>

Queued in the next-integrity branch.

thanks,

Mimi
> ---
>  security/integrity/ima/ima_fs.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> index fa540c0469da..c1265127d1b6 100644
> --- a/security/integrity/ima/ima_fs.c
> +++ b/security/integrity/ima/ima_fs.c
> @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file)
>  	ima_policy = NULL;
>  #elif defined(CONFIG_IMA_WRITE_POLICY)
>  	clear_bit(IMA_FS_BUSY, &ima_fs_flags);
> +#elif defined(CONFIG_IMA_READ_POLICY)
> +	inode->i_mode &= ~S_IWUSR;
>  #endif
>  	return 0;
>  }

Re: [PATCH] ima: Reflect correct permissions for policy

[Mimi Zohar]

Hi Peter,

On Fri, 2018-04-20 at 15:28 +0200, Petr Vorel wrote:
> Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n
> keeps 0600 mode after loading policy. Remove write permission to state
> that policy file no longer be written.
> 
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
> ---
>  security/integrity/ima/ima_fs.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> index fa540c0469da..c1265127d1b6 100644
> --- a/security/integrity/ima/ima_fs.c
> +++ b/security/integrity/ima/ima_fs.c
> @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file)
>  	ima_policy = NULL;
>  #elif defined(CONFIG_IMA_WRITE_POLICY)
>  	clear_bit(IMA_FS_BUSY, &ima_fs_flags);
> +#elif defined(CONFIG_IMA_READ_POLICY)
> +	inode->i_mode &= ~S_IWUSR;
>  #endif
>  	return 0;
>  }

Thinking about this again, do we need to take the i_rwsem lock and
call simple_setattr() as Matthew did in "EVM: Allow runtime
modification of the set of verified xattrs"?

thanks,

Mimi

Re: [PATCH] ima: Reflect correct permissions for policy

[Petr Vorel]

Hi Mimi, Matthew,

> Hi Peter,

> On Fri, 2018-04-20 at 15:28 +0200, Petr Vorel wrote:
> > Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n
> > keeps 0600 mode after loading policy. Remove write permission to state
> > that policy file no longer be written.

> > Signed-off-by: Petr Vorel <pvorel@suse.cz>
> > ---
> >  security/integrity/ima/ima_fs.c | 2 ++
> >  1 file changed, 2 insertions(+)

> > diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> > index fa540c0469da..c1265127d1b6 100644
> > --- a/security/integrity/ima/ima_fs.c
> > +++ b/security/integrity/ima/ima_fs.c
> > @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file)
> >  	ima_policy = NULL;
> >  #elif defined(CONFIG_IMA_WRITE_POLICY)
> >  	clear_bit(IMA_FS_BUSY, &ima_fs_flags);
> > +#elif defined(CONFIG_IMA_READ_POLICY)
> > +	inode->i_mode &= ~S_IWUSR;
> >  #endif
> >  	return 0;
> >  }

> Thinking about this again, do we need to take the i_rwsem lock and
> call simple_setattr() as Matthew did in "EVM: Allow runtime
> modification of the set of verified xattrs"?

Not really sure, I didn't know that EVM is supposed to be used also for sysfs.
Matthew, does it make sense to you?

> thanks,

> Mimi


Kind regards,
Petr