From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1E86C4360D for ; Mon, 9 Sep 2019 00:17:46 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id EDE7221479 for ; Mon, 9 Sep 2019 00:17:45 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EDE7221479 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=namei.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-16878-kernel-hardening=archiver.kernel.org@lists.openwall.com Received: (qmail 30592 invoked by uid 550); 9 Sep 2019 00:17:38 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Received: (qmail 30567 invoked from network); 9 Sep 2019 00:17:37 -0000 Date: Sun, 8 Sep 2019 17:16:23 -0700 (PDT) From: James Morris To: =?ISO-8859-15?Q?Micka=EBl_Sala=FCn?= cc: linux-kernel@vger.kernel.org, Aleksa Sarai , Alexei Starovoitov , Al Viro , Andy Lutomirski , Christian Heimes , Daniel Borkmann , Eric Chiang , Florian Weimer , Jan Kara , Jann Horn , Jonathan Corbet , Kees Cook , Matthew Garrett , Matthew Wilcox , Michael Kerrisk , =?ISO-8859-15?Q?Micka=EBl_Sala=FCn?= , Mimi Zohar , =?ISO-8859-15?Q?Philippe_Tr=E9buchet?= , Scott Shell , Sean Christopherson , Shuah Khan , Song Liu , Steve Dower , Steve Grubb , Thibaut Sautereau , Vincent Strubel , Yves-Alexis Perez , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Mimi Zohar Subject: Re: [PATCH v2 0/5] Add support for O_MAYEXEC In-Reply-To: <20190906152455.22757-1-mic@digikod.net> Message-ID: References: <20190906152455.22757-1-mic@digikod.net> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="1665246916-1947903910-1567986261=:20426" Content-ID: This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1665246916-1947903910-1567986261=:20426 Content-Type: text/plain; CHARSET=ISO-8859-15 Content-Transfer-Encoding: 8BIT Content-ID: On Fri, 6 Sep 2019, Mickaël Salaün wrote: > Furthermore, the security policy can also be delegated to an LSM, either > a MAC system or an integrity system. For instance, the new kernel > MAY_OPENEXEC flag closes a major IMA measurement/appraisal interpreter > integrity gap by bringing the ability to check the use of scripts [2]. To clarify, scripts are already covered by IMA if they're executed directly, and the gap is when invoking a script as a parameter to the interpreter (and for any sourced files). In that case only the interpreter is measured/appraised, unless there's a rule also covering the script file(s). See: https://en.opensuse.org/SDB:Ima_evm#script-behaviour In theory you could probably also close the gap by modifying the interpreters to check for the execute bit on any file opened for interpretation (as earlier suggested by Steve Grubb), and then you could have IMA measure/appraise all files with +x. I suspect this could get messy in terms of unwanted files being included, and the MAY_OPENEXEC flag has cleaner semantics. -- James Morris --1665246916-1947903910-1567986261=:20426--