From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> To: Mimi Zohar <zohar@linux.ibm.com>, Tushar Sugandhi <tusharsu@linux.microsoft.com>, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: tyhicks@linux.microsoft.com, sashal@kernel.org, jmorris@namei.org, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dm-devel@redhat.com Subject: Re: [PATCH v5 6/7] IMA: add critical_data to the built-in policy rules Date: Fri, 6 Nov 2020 15:51:51 -0800 [thread overview] Message-ID: <d92869b5-7244-e29e-5d30-c0e06cf45be1@linux.microsoft.com> (raw) In-Reply-To: <cdcd63f7-ce1f-4463-f886-c36832d7a706@linux.microsoft.com> On 11/6/20 7:37 AM, Lakshmi Ramasubramanian wrote: Hi Mimi, > >> Hi Lakshmi, Tushar, >> >> This patch defines a new critical_data builtin policy. Please update >> the Subject line. >> >> On Sun, 2020-11-01 at 14:26 -0800, Tushar Sugandhi wrote: >>> From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> >>> >>> The IMA hook to measure kernel critical data, namely >>> ima_measure_critical_data(), could be called before a custom IMA policy >>> is loaded. For example, SELinux calls ima_measure_critical_data() to >>> measure its state and policy when they are initialized. This occurs >>> before a custom IMA policy is loaded, and hence IMA hook will not >>> measure the data. A built-in policy is therefore needed to measure >>> critical data provided by callers before a custom IMA policy is loaded. >> >> ^Define a new critical data builtin policy to allow measuring early >> kernel integrity critical data before a custom IMA policy is loaded. > > I will add the above line in the patch description. > >> >> Either remove the references to SELinux or move this patch after the >> subsequent patch which measures SELinux critical data. > > I will remove the reference to SELinux. > I think it would be better to have this patch before the SELinux > measurement patch. > >> >>> >>> Add CRITICAL_DATA to built-in IMA rules if the kernel command line >>> contains "ima_policy=critical_data". Set the IMA template for this rule >>> to "ima-buf" since ima_measure_critical_data() measures a buffer. >>> >>> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> >> >>> --- >>> security/integrity/ima/ima_policy.c | 32 +++++++++++++++++++++++++++++ >>> 1 file changed, 32 insertions(+) >>> >>> diff --git a/security/integrity/ima/ima_policy.c >>> b/security/integrity/ima/ima_policy.c >>> index ec99e0bb6c6f..dc8fe969d3fe 100644 >>> --- a/security/integrity/ima/ima_policy.c >>> +++ b/security/integrity/ima/ima_policy.c >> >>> @@ -875,6 +884,29 @@ void __init ima_init_policy(void) >>> ARRAY_SIZE(default_appraise_rules), >>> IMA_DEFAULT_POLICY); >>> + if (ima_use_critical_data) { >>> + template = lookup_template_desc("ima-buf"); >>> + if (!template) { >>> + ret = -EINVAL; >>> + goto out; >>> + } >>> + >>> + ret = template_desc_init_fields(template->fmt, >>> + &(template->fields), >>> + &(template->num_fields)); >> >> The default IMA template when measuring buffer data is "ima_buf". Is >> there a reason for allocating and initializing it here and not >> deferring it until process_buffer_measurement()? >> > > You are right - good catch. > I will remove the above and validate. > process_buffer_measurement() allocates and initializes "ima-buf" template only when the parameter "func" is NONE. Currently, only ima_check_blacklist() passes NONE for func when calling process_buffer_measurement(). If "func" is anything other than NONE, ima_match_policy() picks the default IMA template if the IMA policy rule does not specify a template. We need to add "ima-buf" in the built-in policy for critical_data so that the default template is not used for buffer measurement. Please let me know if I am missing something. thanks, -lakshmi >> >>> + if (ret) >>> + goto out; >>> + >>> + critical_data_rules[0].template = template; >>> + add_rules(critical_data_rules, >>> + ARRAY_SIZE(critical_data_rules), >>> + IMA_DEFAULT_POLICY); >>> + } >>> + >>> +out: >>> + if (ret) >>> + pr_err("%s failed, result: %d\n", __func__, ret); >>> + >>> ima_update_policy_flag(); >>> } >> >
WARNING: multiple messages have this Message-ID (diff)
From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> To: Mimi Zohar <zohar@linux.ibm.com>, Tushar Sugandhi <tusharsu@linux.microsoft.com>, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: sashal@kernel.org, dm-devel@redhat.com, selinux@vger.kernel.org, jmorris@namei.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, tyhicks@linux.microsoft.com, linux-integrity@vger.kernel.org Subject: Re: [dm-devel] [PATCH v5 6/7] IMA: add critical_data to the built-in policy rules Date: Fri, 6 Nov 2020 15:51:51 -0800 [thread overview] Message-ID: <d92869b5-7244-e29e-5d30-c0e06cf45be1@linux.microsoft.com> (raw) In-Reply-To: <cdcd63f7-ce1f-4463-f886-c36832d7a706@linux.microsoft.com> On 11/6/20 7:37 AM, Lakshmi Ramasubramanian wrote: Hi Mimi, > >> Hi Lakshmi, Tushar, >> >> This patch defines a new critical_data builtin policy. Please update >> the Subject line. >> >> On Sun, 2020-11-01 at 14:26 -0800, Tushar Sugandhi wrote: >>> From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> >>> >>> The IMA hook to measure kernel critical data, namely >>> ima_measure_critical_data(), could be called before a custom IMA policy >>> is loaded. For example, SELinux calls ima_measure_critical_data() to >>> measure its state and policy when they are initialized. This occurs >>> before a custom IMA policy is loaded, and hence IMA hook will not >>> measure the data. A built-in policy is therefore needed to measure >>> critical data provided by callers before a custom IMA policy is loaded. >> >> ^Define a new critical data builtin policy to allow measuring early >> kernel integrity critical data before a custom IMA policy is loaded. > > I will add the above line in the patch description. > >> >> Either remove the references to SELinux or move this patch after the >> subsequent patch which measures SELinux critical data. > > I will remove the reference to SELinux. > I think it would be better to have this patch before the SELinux > measurement patch. > >> >>> >>> Add CRITICAL_DATA to built-in IMA rules if the kernel command line >>> contains "ima_policy=critical_data". Set the IMA template for this rule >>> to "ima-buf" since ima_measure_critical_data() measures a buffer. >>> >>> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> >> >>> --- >>> security/integrity/ima/ima_policy.c | 32 +++++++++++++++++++++++++++++ >>> 1 file changed, 32 insertions(+) >>> >>> diff --git a/security/integrity/ima/ima_policy.c >>> b/security/integrity/ima/ima_policy.c >>> index ec99e0bb6c6f..dc8fe969d3fe 100644 >>> --- a/security/integrity/ima/ima_policy.c >>> +++ b/security/integrity/ima/ima_policy.c >> >>> @@ -875,6 +884,29 @@ void __init ima_init_policy(void) >>> ARRAY_SIZE(default_appraise_rules), >>> IMA_DEFAULT_POLICY); >>> + if (ima_use_critical_data) { >>> + template = lookup_template_desc("ima-buf"); >>> + if (!template) { >>> + ret = -EINVAL; >>> + goto out; >>> + } >>> + >>> + ret = template_desc_init_fields(template->fmt, >>> + &(template->fields), >>> + &(template->num_fields)); >> >> The default IMA template when measuring buffer data is "ima_buf". Is >> there a reason for allocating and initializing it here and not >> deferring it until process_buffer_measurement()? >> > > You are right - good catch. > I will remove the above and validate. > process_buffer_measurement() allocates and initializes "ima-buf" template only when the parameter "func" is NONE. Currently, only ima_check_blacklist() passes NONE for func when calling process_buffer_measurement(). If "func" is anything other than NONE, ima_match_policy() picks the default IMA template if the IMA policy rule does not specify a template. We need to add "ima-buf" in the built-in policy for critical_data so that the default template is not used for buffer measurement. Please let me know if I am missing something. thanks, -lakshmi >> >>> + if (ret) >>> + goto out; >>> + >>> + critical_data_rules[0].template = template; >>> + add_rules(critical_data_rules, >>> + ARRAY_SIZE(critical_data_rules), >>> + IMA_DEFAULT_POLICY); >>> + } >>> + >>> +out: >>> + if (ret) >>> + pr_err("%s failed, result: %d\n", __func__, ret); >>> + >>> ima_update_policy_flag(); >>> } >> > -- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2020-11-06 23:52 UTC|newest] Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-11-01 22:26 [PATCH v5 0/7] IMA: Infrastructure for measurement of critical kernel data Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-01 22:26 ` [PATCH v5 1/7] IMA: generalize keyring specific measurement constructs Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-01 22:26 ` [PATCH v5 2/7] IMA: update process_buffer_measurement to measure buffer hash Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-05 14:30 ` Mimi Zohar 2020-11-05 14:30 ` [dm-devel] " Mimi Zohar 2020-11-12 21:47 ` Tushar Sugandhi 2020-11-12 21:47 ` [dm-devel] " Tushar Sugandhi 2020-11-12 22:19 ` Mimi Zohar 2020-11-12 22:19 ` [dm-devel] " Mimi Zohar 2020-11-12 23:16 ` Tushar Sugandhi 2020-11-12 23:16 ` [dm-devel] " Tushar Sugandhi 2020-11-06 12:11 ` Mimi Zohar 2020-11-06 12:11 ` [dm-devel] " Mimi Zohar 2020-11-12 21:48 ` Tushar Sugandhi 2020-11-12 21:48 ` [dm-devel] " Tushar Sugandhi 2020-11-01 22:26 ` [PATCH v5 3/7] IMA: add hook to measure critical data Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-06 13:24 ` Mimi Zohar 2020-11-06 13:24 ` [dm-devel] " Mimi Zohar 2020-11-12 21:57 ` Tushar Sugandhi 2020-11-12 21:57 ` [dm-devel] " Tushar Sugandhi 2020-11-12 23:56 ` Mimi Zohar 2020-11-12 23:56 ` [dm-devel] " Mimi Zohar 2020-11-13 17:23 ` Tushar Sugandhi 2020-11-13 17:23 ` [dm-devel] " Tushar Sugandhi 2020-11-01 22:26 ` [PATCH v5 4/7] IMA: add policy " Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-06 13:43 ` Mimi Zohar 2020-11-06 13:43 ` [dm-devel] " Mimi Zohar 2020-11-12 22:02 ` Tushar Sugandhi 2020-11-12 22:02 ` [dm-devel] " Tushar Sugandhi 2020-11-01 22:26 ` [PATCH v5 5/7] IMA: validate supported kernel data sources before measurement Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-06 14:01 ` Mimi Zohar 2020-11-06 14:01 ` [dm-devel] " Mimi Zohar 2020-11-12 22:09 ` Tushar Sugandhi 2020-11-12 22:09 ` [dm-devel] " Tushar Sugandhi 2020-11-13 0:06 ` Mimi Zohar 2020-11-13 0:06 ` [dm-devel] " Mimi Zohar 2020-11-01 22:26 ` [PATCH v5 6/7] IMA: add critical_data to the built-in policy rules Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-06 15:24 ` Mimi Zohar 2020-11-06 15:24 ` [dm-devel] " Mimi Zohar 2020-11-06 15:37 ` Lakshmi Ramasubramanian 2020-11-06 15:37 ` [dm-devel] " Lakshmi Ramasubramanian 2020-11-06 23:51 ` Lakshmi Ramasubramanian [this message] 2020-11-06 23:51 ` Lakshmi Ramasubramanian 2020-11-08 15:46 ` Mimi Zohar 2020-11-08 15:46 ` [dm-devel] " Mimi Zohar 2020-11-09 17:24 ` Lakshmi Ramasubramanian 2020-11-01 22:26 ` [PATCH v5 7/7] selinux: measure state and hash of the policy using IMA Tushar Sugandhi 2020-11-01 22:26 ` [dm-devel] " Tushar Sugandhi 2020-11-06 15:47 ` Mimi Zohar 2020-11-06 15:47 ` [dm-devel] " Mimi Zohar 2020-11-05 0:31 ` [PATCH v5 0/7] IMA: Infrastructure for measurement of critical kernel data Mimi Zohar 2020-11-05 0:31 ` [dm-devel] " Mimi Zohar 2020-11-12 22:18 ` Tushar Sugandhi 2020-11-12 22:18 ` [dm-devel] " Tushar Sugandhi
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=d92869b5-7244-e29e-5d30-c0e06cf45be1@linux.microsoft.com \ --to=nramas@linux.microsoft.com \ --cc=agk@redhat.com \ --cc=casey@schaufler-ca.com \ --cc=dm-devel@redhat.com \ --cc=gmazyland@gmail.com \ --cc=jmorris@namei.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=paul@paul-moore.com \ --cc=sashal@kernel.org \ --cc=selinux@vger.kernel.org \ --cc=snitzer@redhat.com \ --cc=stephen.smalley.work@gmail.com \ --cc=tusharsu@linux.microsoft.com \ --cc=tyhicks@linux.microsoft.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.