From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.7 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84708C433E1 for ; Fri, 29 May 2020 07:45:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 69A782074D for ; Fri, 29 May 2020 07:45:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725775AbgE2Hpo (ORCPT ); Fri, 29 May 2020 03:45:44 -0400 Received: from mx2.suse.de ([195.135.220.15]:41714 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725601AbgE2Hpn (ORCPT ); Fri, 29 May 2020 03:45:43 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 15C31B05C; Fri, 29 May 2020 07:45:41 +0000 (UTC) Date: Fri, 29 May 2020 09:45:41 +0200 Message-ID: From: Takashi Iwai To: Roberto Sassu Cc: "linux-integrity@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "Silviu Vlasceanu" Subject: Re: Oops at boot with linux-next kernel with IMA boot options In-Reply-To: <22f1132ebc9d4c2e8fc354efb1845984@huawei.com> References: <4de686af78e94893b3578f6970d783d5@huawei.com> <22f1132ebc9d4c2e8fc354efb1845984@huawei.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On Fri, 29 May 2020 09:33:34 +0200, Roberto Sassu wrote: > > > From: Takashi Iwai [mailto:tiwai@suse.de] > > On Thu, 28 May 2020 19:36:55 +0200, > > Roberto Sassu wrote: > > > > > > > From: linux-integrity-owner@vger.kernel.org [mailto:linux-integrity- > > > > owner@vger.kernel.org] On Behalf Of Takashi Iwai > > > > On Thu, 28 May 2020 17:35:16 +0200, > > > > Takashi Iwai wrote: > > > > > > > > > > Hi Roberto, > > > > > > > > > > it seems that the recent changes in IMA in linux-next caused a > > > > > regression: namely it triggers an Oops when booting with the options > > > > > ima_policy=tcb ima_template_fmt='d-ng|n-ng|d|ng' > > > > > > > > And further experiment revealed that passing only > > ima_template_fmt=d > > > > is enough for triggering the bug. Other formats don't matter. > > > > > > > > (snip) > > > > > It's a KVM instance without any TPM stuff, just passed the options > > > > > above. I could trigger the same bug on a bare metal, too. > > > > > > > > > > Then I performed bisection and it spotted the commit: > > > > > 6f1a1d103b48b1533a9c804e7a069e2c8e937ce7 > > > > > ima: Switch to ima_hash_algo for boot aggregate > > > > > > > > > > Actually reverting this commit fixed the Oops again. > > > > > > > > So, looking at the fact above (triggered by "d") and this bisection > > > > result, it seems that the issue is specific to ima_eventdigest_init(). > > > > The difference from others is that this has a check by > > > > ima_template_hash_algo_allowed(), and currently the check allows only > > > > SHA1 and MD5, while now SHA256 is assigned as default. So I tested > > > > adding SHA256 there like below, and it seems working. > > > > > > > > Hopefully I'm heading to a right direction... > > > > > > Hi Takashi > > > > > > boot_aggregate is the only entry for which there is no file descriptor. > > > The file descriptor is used to recalculate the digest if it is not SHA1 > > > or MD5. For boot_aggregate, we should use instead > > > ima_calc_boot_aggregate(). I will provide a patch. > > > > > > I see that the .file member of event_data in > > > ima_add_boot_aggregate() is not initialized. Can you please try > > > to set .file to NULL? > > > > Tested and it didn't help. The field was already zero-initialized via > > C99-style initialization, I believe. > > Found the issue. > > ima_evendigest_init() returns an error and after that IMA is not > initialized. Unfortunately, ima_must_appraise() does not check > ima_policy_flag, so the kernel crashes when ima_match_policy() > tries to evaluate the policy which is not loaded (ima_rules = NULL). > > if you add at the beginning of ima_must_appraise() > > if (!ima_policy_flag) > return 0; > > the kernel should not crash. Confirmed. The patch below fixed the Oops. When you cook up a proper patch with that change, feel free to put my tested-by tag Reported-and-tested-by: Takashi Iwai Thanks! Takashi --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -53,6 +53,9 @@ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) if (!ima_appraise) return 0; + if (!ima_policy_flag) + return 0; + security_task_getsecid(current, &secid); return ima_match_policy(inode, current_cred(), secid, func, mask, IMA_APPRAISE | IMA_HASH, NULL, NULL, NULL);