From: ebiederm@xmission.com (Eric W. Biederman)
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-fsdevel@vger.kernel.org, Miklos Szeredi <miklos@szeredi.hu>,
Seth Forshee <seth.forshee@canonical.com>,
Dongsu Park <dongsu@kinvolk.io>, Alban Crequy <alban@kinvolk.io>,
"Serge E. Hallyn" <serge@hallyn.com>
Subject: Re: [PATCH v3 4/4] fuse: define the filesystem as untrusted
Date: Tue, 13 Mar 2018 14:32:58 -0500 [thread overview]
Message-ID: <87a7vbydn9.fsf@xmission.com> (raw)
In-Reply-To: <1520540650-7451-5-git-send-email-zohar@linux.vnet.ibm.com> (Mimi Zohar's message of "Thu, 8 Mar 2018 15:24:10 -0500")
Mimi Zohar <zohar@linux.vnet.ibm.com> writes:
> Files on FUSE can change at any point in time without IMA being able
> to detect it. The file data read for the file signature verification
> could be totally different from what is subsequently read, making the
> signature verification useless.
>
> FUSE can be mounted by unprivileged users either today with fusermount
> installed with setuid, or soon with the upcoming patches to allow FUSE
> mounts in a non-init user namespace.
>
> This patch sets the SB_I_IMA_UNVERIFIABLE_SIGNATURE flag and when
> appropriate sets the SB_I_UNTRUSTED_MOUNTER flag.
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
>
> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
> Cc: Miklos Szeredi <miklos@szeredi.hu>
> Cc: Seth Forshee <seth.forshee@canonical.com>
> Cc: Eric W. Biederman <ebiederm@xmission.com>
> Cc: Dongsu Park <dongsu@kinvolk.io>
> Cc: Alban Crequy <alban@kinvolk.io>
> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> ---
> fs/fuse/inode.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
> index 624f18bbfd2b..ef309958e060 100644
> --- a/fs/fuse/inode.c
> +++ b/fs/fuse/inode.c
> @@ -1080,6 +1080,9 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
> sb->s_maxbytes = MAX_LFS_FILESIZE;
> sb->s_time_gran = 1;
> sb->s_export_op = &fuse_export_operations;
> + sb->s_iflags |= SB_I_IMA_UNVERIFIABLE_SIGNATURE;
> + if (sb->s_user_ns != &init_user_ns)
> + sb->s_iflags |= SB_I_UNTRUSTED_MOUNTER;
>
> file = fget(d.fd);
> err = -EINVAL;
next prev parent reply other threads:[~2018-03-13 19:33 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-08 20:24 [PATCH v3 0/4] unverifiable file signatures Mimi Zohar
2018-03-08 20:24 ` [PATCH v3 1/4] ima: fail file signature verification on non-init mounted filesystems Mimi Zohar
2018-03-12 19:17 ` Serge E. Hallyn
2018-03-12 19:26 ` Serge E. Hallyn
2018-03-13 18:45 ` Eric W. Biederman
2018-03-08 20:24 ` [PATCH v3 2/4] ima: re-evaluate files on privileged " Mimi Zohar
2018-03-12 19:18 ` Serge E. Hallyn
2018-03-13 19:24 ` Eric W. Biederman
2018-03-08 20:24 ` [PATCH v3 3/4] ima: fail signature verification based on policy Mimi Zohar
2018-03-12 19:28 ` Serge E. Hallyn
2018-03-12 19:32 ` Mimi Zohar
2018-03-13 19:31 ` Eric W. Biederman
2018-03-08 20:24 ` [PATCH v3 4/4] fuse: define the filesystem as untrusted Mimi Zohar
2018-03-12 19:29 ` Serge E. Hallyn
2018-03-13 14:46 ` Stefan Berger
2018-03-14 14:27 ` Serge E. Hallyn
2018-03-14 14:37 ` Stefan Berger
2018-03-13 19:32 ` Eric W. Biederman [this message]
2018-03-19 11:57 ` Mimi Zohar
2018-03-14 7:52 ` Stef Bon
2018-03-14 13:01 ` Mimi Zohar
2018-03-14 16:17 ` Eric W. Biederman
2018-03-14 17:50 ` Mimi Zohar
2018-03-14 18:08 ` Chuck Lever
2018-03-14 19:46 ` Eric W. Biederman
2018-03-14 20:34 ` Chuck Lever
2018-03-14 21:42 ` Eric W. Biederman
2018-03-14 22:53 ` Michael Halcrow
2018-03-15 21:24 ` Mimi Zohar
2018-03-15 10:07 ` Stef Bon
2018-03-15 13:53 ` Chuck Lever
2018-03-15 22:05 ` Mimi Zohar
2018-03-13 19:40 ` [PATCH v3 0/4] unverifiable file signatures Eric W. Biederman
2018-03-13 20:40 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87a7vbydn9.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=alban@kinvolk.io \
--cc=dongsu@kinvolk.io \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=serge@hallyn.com \
--cc=seth.forshee@canonical.com \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).