Re: [PATCH RFC v11 9/19] ipe: add permissive toggle

From: Fan Wu <wufan@linux.microsoft.com>
To: Paul Moore <paul@paul-moore.com>,
	corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org,
	serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org,
	axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org,
	eparis@redhat.com
Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-fscrypt@vger.kernel.org, linux-block@vger.kernel.org,
	dm-devel@redhat.com, audit@vger.kernel.org,
	roberto.sassu@huawei.com, linux-kernel@vger.kernel.org,
	Deven Bowers <deven.desai@linux.microsoft.com>
Subject: Re: [PATCH RFC v11 9/19] ipe: add permissive toggle
Date: Thu, 2 Nov 2023 15:56:51 -0700	[thread overview]
Message-ID: <b315474c-77f7-49c1-8983-c8d1de80cc86@linux.microsoft.com> (raw)
In-Reply-To: <1ef52e983dd5b9a7759dc76bfe156804.paul@paul-moore.com>


On 10/23/2023 8:52 PM, Paul Moore wrote:
> On Oct  4, 2023 Fan Wu <wufan@linux.microsoft.com> wrote:
>>
>> IPE, like SELinux, supports a permissive mode. This mode allows policy
>> authors to test and evaluate IPE policy without it effecting their
>> programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
>> be reported.
>>
>> This patch adds the following audit records:
>>
>>      audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295
>>        ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
>>      audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295
>>        ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
>>
>> The audit record only emit when the value from the user input is
>> different from the current enforce value.
>>
>> Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
>> Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
>> ---
>> v2:
>>    + Split evaluation loop, access control hooks,
>>      and evaluation loop from policy parser and userspace
>>      interface to pass mailing list character limit
>>
>> v3:
>>    + Move ipe_load_properties to patch 04.
>>    + Remove useless 0-initializations
>>    + Prefix extern variables with ipe_
>>    + Remove kernel module parameters, as these are
>>      exposed through sysctls.
>>    + Add more prose to the IPE base config option
>>      help text.
>>    + Use GFP_KERNEL for audit_log_start.
>>    + Remove unnecessary caching system.
>>    + Remove comments from headers
>>    + Use rcu_access_pointer for rcu-pointer null check
>>    + Remove usage of reqprot; use prot only.
>>    + Move policy load and activation audit event to 03/12
>>
>> v4:
>>    + Remove sysctls in favor of securityfs nodes
>>    + Re-add kernel module parameters, as these are now
>>      exposed through securityfs.
>>    + Refactor property audit loop to a separate function.
>>
>> v5:
>>    + fix minor grammatical errors
>>    + do not group rule by curly-brace in audit record,
>>      reconstruct the exact rule.
>>
>> v6:
>>    + No changes
>>
>> v7:
>>    + Further split lsm creation into a separate commit from the
>>      evaluation loop and audit system, for easier review.
>>    + Propagating changes to support the new ipe_context structure in the
>>      evaluation loop.
>>    + Split out permissive functionality into a separate patch for easier
>>      review.
>>    + Remove permissive switch compile-time configuration option - this
>>      is trivial to add later.
>>
>> v8:
>>    + Remove "IPE" prefix from permissive audit record
>>    + align fields to the linux-audit field dictionary. This causes the
>>      following fields to change:
>>        enforce -> permissive
>>
>>    + Remove duplicated information correlated with syscall record, that
>>      will always be present in the audit event.
>>    + Change audit types:
>>      + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
>>        + There is no significant difference in meaning between
>>          these types.
>>
>> v9:
>>    + Clean up ipe_context related code
>>
>> v10:
>>    + Change audit format to comform with the existing format selinux is
>>      using
>>    + Remove the audit record emission during init to align with selinux,
>>      which does not perform this action.
>>
>> v11:
>>    + Remove redundant code
>> ---
>>   security/ipe/audit.c | 22 ++++++++++++++
>>   security/ipe/audit.h |  1 +
>>   security/ipe/eval.c  | 14 +++++++--
>>   security/ipe/eval.h  |  1 +
>>   security/ipe/fs.c    | 68 ++++++++++++++++++++++++++++++++++++++++++++
>>   5 files changed, 104 insertions(+), 2 deletions(-)
> 
> ...
> 
>> diff --git a/security/ipe/eval.c b/security/ipe/eval.c
>> index 499b6b3338f2..78c54ff1fdd3 100644
>> --- a/security/ipe/eval.c
>> +++ b/security/ipe/eval.c
>> @@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
>>   	ipe_audit_match(ctx, match_type, action, rule);
>>   
>>   	if (action == IPE_ACTION_DENY)
>> -		return -EACCES;
>> +		rc = -EACCES;
>> +
>> +	if (!enforcing)
>> +		rc = 0;
> 
> Why the local @enforcing variable?  Why not:
> 
>    if (!READ_ONCE(enforce))
>      rc = 0;
> 

Yes the variable is unnecessary, I will remove it.
-Fan
>> -	return 0;
>> +	return rc;
>>   }
>>   
>>   /**
>> @@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb)
>>   
>>   module_param(success_audit, bool, 0400);
>>   MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
>> +module_param(enforce, bool, 0400);
>> +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");
> 
> "enforcing"
> 
> --
> paul-moore.com