From: Mimi Zohar <zohar@linux.ibm.com>
To: Casey Schaufler <casey@schaufler-ca.com>,
casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: john.johansen@canonical.com, linux-kernel@vger.kernel.org,
linux-audit@redhat.com, bpf@vger.kernel.org, sds@tycho.nsa.gov
Subject: Re: [PATCH v23 02/23] LSM: Create and manage the lsmblob data structure.
Date: Mon, 28 Dec 2020 17:14:48 -0500 [thread overview]
Message-ID: <07784164969d0c31debd9defaedb46d89409ad78.camel@linux.ibm.com> (raw)
In-Reply-To: <886fcd04-6a08-d78c-dc82-301c991e5ad8@schaufler-ca.com>
On Mon, 2020-12-28 at 12:06 -0800, Casey Schaufler wrote:
> On 12/28/2020 11:24 AM, Mimi Zohar wrote:
> > Hi Casey,
> >
> > On Fri, 2020-11-20 at 12:14 -0800, Casey Schaufler wrote:
> >> diff --git a/security/security.c b/security/security.c
> >> index 5da8b3643680..d01363cb0082 100644
> >> --- a/security/security.c
> >> +++ b/security/security.c
> >>
> >> @@ -2510,7 +2526,24 @@ int security_key_getsecurity(struct key *key, char **_buffer)
> >>
> >> int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
> >> {
> >> - return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
> >> + struct security_hook_list *hp;
> >> + bool one_is_good = false;
> >> + int rc = 0;
> >> + int trc;
> >> +
> >> + hlist_for_each_entry(hp, &security_hook_heads.audit_rule_init, list) {
> >> + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
> >> + continue;
> >> + trc = hp->hook.audit_rule_init(field, op, rulestr,
> >> + &lsmrule[hp->lsmid->slot]);
> >> + if (trc == 0)
> >> + one_is_good = true;
> >> + else
> >> + rc = trc;
> >> + }
> >> + if (one_is_good)
> >> + return 0;
> >> + return rc;
> >> }
> > So the same string may be defined by multiple LSMs.
>
> Yes. Any legal AppArmor label would also be a legal Smack label.
>
> >> int security_audit_rule_known(struct audit_krule *krule)
> >> @@ -2518,14 +2551,31 @@ int security_audit_rule_known(struct audit_krule *krule)
> >> return call_int_hook(audit_rule_known, 0, krule);
> >> }
> >>
> >> -void security_audit_rule_free(void *lsmrule)
> >> +void security_audit_rule_free(void **lsmrule)
> >> {
> >> - call_void_hook(audit_rule_free, lsmrule);
> >> + struct security_hook_list *hp;
> >> +
> >> + hlist_for_each_entry(hp, &security_hook_heads.audit_rule_free, list) {
> >> + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
> >> + continue;
> >> + hp->hook.audit_rule_free(lsmrule[hp->lsmid->slot]);
> >> + }
> >> }
> >>
> > If one LSM frees the string, then the string is deleted from all LSMs.
> > I don't understand how this safe.
>
> The audit system doesn't have a way to specify which LSM
> a watched label is associated with. Even if we added one,
> we'd still have to address the current behavior. Assigning
> the watch to all modules means that seeing the string
> in any module is sufficient to generate the event.
I originally thought loading a new LSM policy could not delete existing
LSM labels, but that isn't true. If LSM labels can come and go based
on policy, with this code, could loading a new policy for one LSM
result in deleting labels of another LSM?
>
> >
> >> -int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
> >> +int security_audit_rule_match(u32 secid, u32 field, u32 op, void **lsmrule)
> >> {
> >> - return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule);
> >> + struct security_hook_list *hp;
> >> + int rc;
> >> +
> >> + hlist_for_each_entry(hp, &security_hook_heads.audit_rule_match, list) {
> >> + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
> >> + continue;
> >> + rc = hp->hook.audit_rule_match(secid, field, op,
> >> + &lsmrule[hp->lsmid->slot]);
> >> + if (rc)
> >> + return rc;
> > Suppose that there is an IMA dont_measure or dont_appraise rule, if one
> > LSM matches, then this returns true, causing any measurement or
> > integrity verification to be skipped.
>
> Yes, that is correct. Like the audit system, you're doing a string based
> lookup, which pretty well has to work this way. I have proposed compound
> label specifications in the past, but even if we accepted something like
> "apparmor=dates,selinux=figs" we'd still have to be compatible with the
> old style inputs.
>
> >
> > Sample policy rules:
> > dont_measure obj_type=foo_log
> > dont_appraise obj_type=foo_log
IMA could extend the existing policy rules like "lsm=[selinux] |
[smack] | [apparmor]", but that assumes that the underlying
infrastructure supports it.
> >
> > Are there any plans to prevent label collisions or at least notify of a
> > label collision?
>
> What would that look like? You can't say that Smack isn't allowed
> to use valid AppArmor labels. How would Smack know? If the label is
> valid to both, how would you decide which LSM gets to use it?
As this is a runtime issue, when loading a new policy at least flag the
collision. When removing the label, when it is defined by multiple
LSMs, at least flag the removal.
>
> >
> >> + }
> >> + return 0;
> >> }
> >> #endif /* CONFIG_AUDIT */
>
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-12-30 1:10 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20201120201507.11993-1-casey.ref@schaufler-ca.com>
2020-11-20 20:14 ` [PATCH v22 00/23] LSM: Module stacking for AppArmor Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 01/23] LSM: Infrastructure management of the sock security Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 02/23] LSM: Create and manage the lsmblob data structure Casey Schaufler
2020-12-28 17:54 ` Mimi Zohar
2020-12-28 19:22 ` Casey Schaufler
2020-12-28 19:43 ` Mimi Zohar
2020-12-28 19:24 ` Mimi Zohar
2020-12-28 20:06 ` Casey Schaufler
2020-12-28 22:14 ` Mimi Zohar [this message]
2020-12-28 23:20 ` Casey Schaufler
2020-12-29 1:53 ` Mimi Zohar
2020-12-29 13:53 ` Mimi Zohar
2020-12-29 18:46 ` Casey Schaufler
2020-12-29 19:16 ` Mimi Zohar
2020-11-20 20:14 ` [PATCH v23 03/23] LSM: Use lsmblob in security_audit_rule_match Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 04/23] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 05/23] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 06/23] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 07/23] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 08/23] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 09/23] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 10/23] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 11/23] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 12/23] LSM: Specify which LSM to display Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 13/23] LSM: Ensure the correct LSM context releaser Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 14/23] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 15/23] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 16/23] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 17/23] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 18/23] LSM: Verify LSM display sanity in binder Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 19/23] audit: add support for non-syscall auxiliary records Casey Schaufler
2020-11-20 23:06 ` kernel test robot
2020-11-21 0:36 ` kernel test robot
2020-11-21 7:36 ` kernel test robot
2020-11-20 20:15 ` [PATCH v23 20/23] Audit: Add new record for multiple process LSM attributes Casey Schaufler
2020-11-20 22:51 ` kernel test robot
2020-11-21 0:02 ` kernel test robot
2020-11-20 20:15 ` [PATCH v23 21/23] Audit: Add a new record for multiple object " Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 22/23] LSM: Add /proc attr entry for full LSM context Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 23/23] AppArmor: Remove the exclusive flag Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=07784164969d0c31debd9defaedb46d89409ad78.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=bpf@vger.kernel.org \
--cc=casey.schaufler@intel.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).