From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83809C28CBC for ; Wed, 6 May 2020 15:42:04 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id B3B2E206DB for ; Wed, 6 May 2020 15:42:03 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B3B2E206DB Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=cyphar.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-18729-kernel-hardening=archiver.kernel.org@lists.openwall.com Received: (qmail 1420 invoked by uid 550); 6 May 2020 15:41:55 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Received: (qmail 1396 invoked from network); 6 May 2020 15:41:54 -0000 X-Virus-Scanned: amavisd-new at heinlein-support.de Date: Thu, 7 May 2020 01:41:17 +1000 From: Aleksa Sarai To: "Lev R. Oshvang ." Cc: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= , linux-kernel@vger.kernel.org, Alexei Starovoitov , Al Viro , Andy Lutomirski , Christian Heimes , Daniel Borkmann , Deven Bowers , Eric Chiang , Florian Weimer , James Morris , Jan Kara , Jann Horn , Jonathan Corbet , Kees Cook , Lakshmi Ramasubramanian , Matthew Garrett , Matthew Wilcox , Michael Kerrisk , =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= , Mimi Zohar , Philippe =?utf-8?Q?Tr=C3=A9buchet?= , Scott Shell , Sean Christopherson , Shuah Khan , Steve Dower , Steve Grubb , Thibaut Sautereau , Vincent Strubel , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-integrity@vger.kernel.org, LSM List , linux-fsdevel@vger.kernel.org Subject: Re: [PATCH v5 0/6] Add support for O_MAYEXEC Message-ID: <20200506154117.gibiibfytrdl4exo@yavin.dot.cyphar.com> References: <20200505153156.925111-1-mic@digikod.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ljnqns477wlvxj5l" Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: BECC31754 X-Rspamd-Score: -7.67 / 15.00 / 15.00 --ljnqns477wlvxj5l Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2020-05-06, Lev R. Oshvang . wrote: > On Tue, May 5, 2020 at 6:36 PM Micka=EBl Sala=FCn wrote: > > > > > > On 05/05/2020 17:31, Micka=EBl Sala=FCn wrote: > > > Hi, > > > > > > This fifth patch series add new kernel configurations (OMAYEXEC_STATI= C, > > > OMAYEXEC_ENFORCE_MOUNT, and OMAYEXEC_ENFORCE_FILE) to enable to > > > configure the security policy at kernel build time. As requested by > > > Mimi Zohar, I completed the series with one of her patches for IMA. > > > > > > The goal of this patch series is to enable to control script execution > > > with interpreters help. A new O_MAYEXEC flag, usable through > > > openat2(2), is added to enable userspace script interpreter to delega= te > > > to the kernel (and thus the system security policy) the permission to > > > interpret/execute scripts or other files containing what can be seen = as > > > commands. > > > > > > A simple system-wide security policy can be enforced by the system > > > administrator through a sysctl configuration consistent with the mount > > > points or the file access rights. The documentation patch explains t= he > > > prerequisites. > > > > > > Furthermore, the security policy can also be delegated to an LSM, eit= her > > > a MAC system or an integrity system. For instance, the new kernel > > > MAY_OPENEXEC flag closes a major IMA measurement/appraisal interpreter > > > integrity gap by bringing the ability to check the use of scripts [1]. > > > Other uses are expected, such as for openat2(2) [2], SGX integration > > > [3], bpffs [4] or IPE [5]. > > > > > > Userspace needs to adapt to take advantage of this new feature. For > > > example, the PEP 578 [6] (Runtime Audit Hooks) enables Python 3.8 to = be > > > extended with policy enforcement points related to code interpretatio= n, > > > which can be used to align with the PowerShell audit features. > > > Additional Python security improvements (e.g. a limited interpreter > > > withou -c, stdin piping of code) are on their way. > > > > > > The initial idea come from CLIP OS 4 and the original implementation = has > > > been used for more than 12 years: > > > https://github.com/clipos-archive/clipos4_doc > > > > > > An introduction to O_MAYEXEC was given at the Linux Security Summit > > > Europe 2018 - Linux Kernel Security Contributions by ANSSI: > > > https://www.youtube.com/watch?v=3DchNjCRtPKQY&t=3D17m15s > > > The "write xor execute" principle was explained at Kernel Recipes 201= 8 - > > > CLIP OS: a defense-in-depth OS: > > > https://www.youtube.com/watch?v=3DPjRE0uBtkHU&t=3D11m14s > > > > > > This patch series can be applied on top of v5.7-rc4. This can be tes= ted > > > with CONFIG_SYSCTL. I would really appreciate constructive comments = on > > > this patch series. > > > > > > Previous version: > > > https://lore.kernel.org/lkml/20200428175129.634352-1-mic@digikod.net/ > > > > The previous version (v4) is > > https://lore.kernel.org/lkml/20200430132320.699508-1-mic@digikod.net/ >=20 >=20 > Hi Michael >=20 > I have couple of question > 1. Why you did not add O_MAYEXEC to open()? > Some time ago (around v4.14) open() did not return EINVAL when > VALID_OPEN_FLAGS check failed. > Now it does, so I do not see a problem that interpreter will use > simple open(), ( Although that path might be manipulated, but file > contents will be verified by IMA) You don't get -EINVAL from open() in the case of unknown flags, that's something only openat2() does in the open*() family. Hence why it's only introduced for openat2(). > 2. When you apply a new flag to mount, it means that IMA will check > all files under this mount and it does not matter whether the file in > question is a script or not. > IMHO it is too hard overhead for performance reasons. >=20 > Regards, > LEv --=20 Aleksa Sarai Senior Software Engineer (Containers) SUSE Linux GmbH --ljnqns477wlvxj5l Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQSxZm6dtfE8gxLLfYqdlLljIbnQEgUCXrLamgAKCRCdlLljIbnQ Eo2EAQDv6NtU9F0Nl45n0HGqLDKRn1IEH5GBUZwhlkUR72xbbAD8CqwZXGFnsYZB +Che7WXy1zSGWAJq84tQAqCqj97ABAQ= =EWAe -----END PGP SIGNATURE----- --ljnqns477wlvxj5l--