[PATCH v3 0/1] ima: fix boot command line issue

[PATCH v3 0/1] ima: fix boot command line issue

[GUO Zihua]

Change log:
  v3:
    Update commit message following Mimi's advice, update comments for
    config.
  v2:
    update commit message and subject following Mimi's advice. Remove
    references for CONFIG_IMA_TEMPLATE as well.

GUO Zihua (1):
  ima: remove the IMA_TEMPLATE Kconfig option

 security/integrity/ima/Kconfig | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

-- 
2.17.1

[PATCH v3 1/1] ima: remove the IMA_TEMPLATE Kconfig option

[GUO Zihua]

The original 'ima' measurement list template contains a hash, defined
as 20 bytes, and a null terminated pathname, limited to 255
characters.  Other measurement list templates permit both larger hashes
and longer pathnames.  When the "ima" template is configured as the
default, a new measurement list template (ima_template=) must be
specified before specifying a larger hash algorithm (ima_hash=) on the
boot command line.

To avoid this boot command line ordering issue, remove the legacy "ima"
template configuration option, allowing it to still be specified on the
boot command line.

The root cause of this issue is that during the processing of ima_hash,
we would try to check whether the hash algorithm is compatible with the
template. If the template is not set at the moment we do the check, we
check the algorithm against the configured default template. If the
default template is "ima", then we reject any hash algorithm other than
sha1 and md5.

For example, if the compiled default template is "ima", and the default
algorithm is sha1 (which is the current default). In the cmdline, we put
in "ima_hash=sha256 ima_template=ima-ng". The expected behavior would be
that ima starts with ima-ng as the template and sha256 as the hash
algorithm. However, during the processing of "ima_hash=",
"ima_template=" has not been processed yet, and hash_setup would check
the configured hash algorithm against the compiled default: ima, and
reject sha256. So at the end, the hash algorithm that is actually used
will be sha1.

With template "ima" removed from the configured default, we ensure that
the default tempalte would at least be "ima-ng" which allows for
basically any hash algorithm.

This change would not break the algorithm compatibility checks for IMA.

Fixes: 4286587dccd43 ("ima: add Kconfig default measurement list template")
Signed-off-by: GUO Zihua <guozihua@huawei.com>
---
 security/integrity/ima/Kconfig | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index f3a9cc201c8c..7249f16257c7 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -69,10 +69,9 @@ choice
 	  hash, defined as 20 bytes, and a null terminated pathname,
 	  limited to 255 characters.  The 'ima-ng' measurement list
 	  template permits both larger hash digests and longer
-	  pathnames.
+	  pathnames. The configured default template can be replaced
+	  by specifying "ima_template=" on the boot command line.
 
-	config IMA_TEMPLATE
-		bool "ima"
 	config IMA_NG_TEMPLATE
 		bool "ima-ng (default)"
 	config IMA_SIG_TEMPLATE
@@ -82,7 +81,6 @@ endchoice
 config IMA_DEFAULT_TEMPLATE
 	string
 	depends on IMA
-	default "ima" if IMA_TEMPLATE
 	default "ima-ng" if IMA_NG_TEMPLATE
 	default "ima-sig" if IMA_SIG_TEMPLATE
 
@@ -102,19 +100,19 @@ choice
 
 	config IMA_DEFAULT_HASH_SHA256
 		bool "SHA256"
-		depends on CRYPTO_SHA256=y && !IMA_TEMPLATE
+		depends on CRYPTO_SHA256=y
 
 	config IMA_DEFAULT_HASH_SHA512
 		bool "SHA512"
-		depends on CRYPTO_SHA512=y && !IMA_TEMPLATE
+		depends on CRYPTO_SHA512=y
 
 	config IMA_DEFAULT_HASH_WP512
 		bool "WP512"
-		depends on CRYPTO_WP512=y && !IMA_TEMPLATE
+		depends on CRYPTO_WP512=y
 
 	config IMA_DEFAULT_HASH_SM3
 		bool "SM3"
-		depends on CRYPTO_SM3=y && !IMA_TEMPLATE
+		depends on CRYPTO_SM3=y
 endchoice
 
 config IMA_DEFAULT_HASH
-- 
2.17.1

Re: [PATCH v3 1/1] ima: remove the IMA_TEMPLATE Kconfig option

[Mimi Zohar]

On Thu, 2022-04-07 at 10:16 +0800, GUO Zihua wrote:
> The original 'ima' measurement list template contains a hash, defined
> as 20 bytes, and a null terminated pathname, limited to 255
> characters.  Other measurement list templates permit both larger hashes
> and longer pathnames.  When the "ima" template is configured as the
> default, a new measurement list template (ima_template=) must be
> specified before specifying a larger hash algorithm (ima_hash=) on the
> boot command line.
> 
> To avoid this boot command line ordering issue, remove the legacy "ima"
> template configuration option, allowing it to still be specified on the
> boot command line.
> 
> The root cause of this issue is that during the processing of ima_hash,
> we would try to check whether the hash algorithm is compatible with the
> template. If the template is not set at the moment we do the check, we
> check the algorithm against the configured default template. If the
> default template is "ima", then we reject any hash algorithm other than
> sha1 and md5.
> 
> For example, if the compiled default template is "ima", and the default
> algorithm is sha1 (which is the current default). In the cmdline, we put
> in "ima_hash=sha256 ima_template=ima-ng". The expected behavior would be
> that ima starts with ima-ng as the template and sha256 as the hash
> algorithm. However, during the processing of "ima_hash=",
> "ima_template=" has not been processed yet, and hash_setup would check
> the configured hash algorithm against the compiled default: ima, and
> reject sha256. So at the end, the hash algorithm that is actually used
> will be sha1.
> 
> With template "ima" removed from the configured default, we ensure that
> the default tempalte would at least be "ima-ng" which allows for
> basically any hash algorithm.
> 
> This change would not break the algorithm compatibility checks for IMA.
> 
> Fixes: 4286587dccd43 ("ima: add Kconfig default measurement list template")
> Signed-off-by: GUO Zihua <guozihua@huawei.com>

thanks,

Mimi

Re: [PATCH v3 1/1] ima: remove the IMA_TEMPLATE Kconfig option

[Guozihua (Scott)]

On 2022/4/7 22:43, Mimi Zohar wrote:
> On Thu, 2022-04-07 at 10:16 +0800, GUO Zihua wrote:
>> The original 'ima' measurement list template contains a hash, defined
>> as 20 bytes, and a null terminated pathname, limited to 255
>> characters.  Other measurement list templates permit both larger hashes
>> and longer pathnames.  When the "ima" template is configured as the
>> default, a new measurement list template (ima_template=) must be
>> specified before specifying a larger hash algorithm (ima_hash=) on the
>> boot command line.
>>
>> To avoid this boot command line ordering issue, remove the legacy "ima"
>> template configuration option, allowing it to still be specified on the
>> boot command line.
>>
>> The root cause of this issue is that during the processing of ima_hash,
>> we would try to check whether the hash algorithm is compatible with the
>> template. If the template is not set at the moment we do the check, we
>> check the algorithm against the configured default template. If the
>> default template is "ima", then we reject any hash algorithm other than
>> sha1 and md5.
>>
>> For example, if the compiled default template is "ima", and the default
>> algorithm is sha1 (which is the current default). In the cmdline, we put
>> in "ima_hash=sha256 ima_template=ima-ng". The expected behavior would be
>> that ima starts with ima-ng as the template and sha256 as the hash
>> algorithm. However, during the processing of "ima_hash=",
>> "ima_template=" has not been processed yet, and hash_setup would check
>> the configured hash algorithm against the compiled default: ima, and
>> reject sha256. So at the end, the hash algorithm that is actually used
>> will be sha1.
>>
>> With template "ima" removed from the configured default, we ensure that
>> the default tempalte would at least be "ima-ng" which allows for
>> basically any hash algorithm.
>>
>> This change would not break the algorithm compatibility checks for IMA.
>>
>> Fixes: 4286587dccd43 ("ima: add Kconfig default measurement list template")
>> Signed-off-by: GUO Zihua <guozihua@huawei.com>
> 
> thanks,
> 
> Mimi
> 
> 
> .

Hi,

Is this patch picked?

Thanks
GUO Zihua

Re: [PATCH v3 1/1] ima: remove the IMA_TEMPLATE Kconfig option

[Mimi Zohar]

On Thu, 2022-05-05 at 09:35 +0800, Guozihua (Scott) wrote:
> Hi,
> 
> Is this patch picked?

Yes, the patch is queued in next-integrity, which feeds into linux-
next.  For the future, you can check 
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git.

-- 
thanks,

Mimi

Re: [PATCH v3 1/1] ima: remove the IMA_TEMPLATE Kconfig option

[Guozihua (Scott)]

On 2022/5/5 20:39, Mimi Zohar wrote:
> On Thu, 2022-05-05 at 09:35 +0800, Guozihua (Scott) wrote:
>> Hi,
>>
>> Is this patch picked?
> 
> Yes, the patch is queued in next-integrity, which feeds into linux-
> next.  For the future, you can check
> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git.
> 
Thanks Mimi!

-- 
Best
GUO Zihua

Re: [PATCH v3 0/1] ima: fix boot command line issue

[Mimi Zohar]

On Thu, 2022-04-07 at 10:16 +0800, GUO Zihua wrote:
> Change log:
>   v3:
>     Update commit message following Mimi's advice, update comments for
>     config.
>   v2:
>     update commit message and subject following Mimi's advice. Remove
>     references for CONFIG_IMA_TEMPLATE as well.

For future referece, the change log can be added after the break line
(---) in the patch itself.  No need for a cover letter for a single
patch.

thanks,

Mimi

Re: [PATCH v3 0/1] ima: fix boot command line issue

[Guozihua (Scott)]

On 2022/4/7 20:46, Mimi Zohar wrote:
> On Thu, 2022-04-07 at 10:16 +0800, GUO Zihua wrote:
>> Change log:
>>    v3:
>>      Update commit message following Mimi's advice, update comments for
>>      config.
>>    v2:
>>      update commit message and subject following Mimi's advice. Remove
>>      references for CONFIG_IMA_TEMPLATE as well.
> 
> For future referece, the change log can be added after the break line
> (---) in the patch itself.  No need for a cover letter for a single
> patch.
> 
> thanks,
> 
> Mimi
> 
> 
> .

Thanks Mimi, will do this next time.

-- 
Best
GUO Zihua