From: Mimi Zohar <zohar@linux.ibm.com>
To: Roberto Sassu <roberto.sassu@huawei.com>, mjg59@google.com
Cc: linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, silviu.vlasceanu@huawei.com,
stable@vger.kernel.org
Subject: Re: [PATCH 07/11] evm: Set IMA_CHANGE_XATTR/ATTR bit if EVM_ALLOW_METADATA_WRITES is set
Date: Mon, 24 Aug 2020 08:17:56 -0400 [thread overview]
Message-ID: <67cafcf63daf8e418871eb5302e7327ba851e253.camel@linux.ibm.com> (raw)
In-Reply-To: <20200618160458.1579-7-roberto.sassu@huawei.com>
On Thu, 2020-06-18 at 18:04 +0200, Roberto Sassu wrote:
> When EVM_ALLOW_METADATA_WRITES is set, EVM allows any operation on
> metadata. Its main purpose is to allow users to freely set metadata when
> they are protected by a portable signature, until the HMAC key is loaded.
>
> However, IMA is not notified about metadata changes and, after the first
> appraisal, always allows access to the files without checking metadata
> again.
^after the first successful appraisal
>
> This patch checks in evm_reset_status() if EVM_ALLOW_METADATA WRITES is
> enabled and if it is, sets the IMA_CHANGE_XATTR/ATTR bits depending on the
> operation performed. At the next appraisal, metadata are revalidated.
EVM modifying IMA bits crosses the boundary between EVM and IMA. There
is already an IMA post_setattr hook. IMA could reset its own bit
there. If necessary EVM could export as a function it's status info.
Mimi
>
> This patch also adds a call to evm_reset_status() in
> evm_inode_post_setattr() so that EVM won't return the cached status the
> next time appraisal is performed.
>
> Cc: stable@vger.kernel.org # 4.16.x
> Fixes: ae1ba1676b88e ("EVM: Allow userland to permit modification of EVM-protected metadata")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
> security/integrity/evm/evm_main.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> index 41cc6a4aaaab..d4d918183094 100644
> --- a/security/integrity/evm/evm_main.c
> +++ b/security/integrity/evm/evm_main.c
> @@ -478,13 +478,17 @@ int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)
> return evm_protect_xattr(dentry, xattr_name, NULL, 0);
> }
>
> -static void evm_reset_status(struct inode *inode)
> +static void evm_reset_status(struct inode *inode, int bit)
> {
> struct integrity_iint_cache *iint;
>
> iint = integrity_iint_find(inode);
> - if (iint)
> + if (iint) {
> + if (evm_initialized & EVM_ALLOW_METADATA_WRITES)
> + set_bit(bit, &iint->atomic_flags);
> +
> iint->evm_status = INTEGRITY_UNKNOWN;
> + }
> }
>
> /**:q
> @@ -507,7 +511,7 @@ void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,
> && !posix_xattr_acl(xattr_name)))
> return;
>
> - evm_reset_status(dentry->d_inode);
> + evm_reset_status(dentry->d_inode, IMA_CHANGE_XATTR);
>
> evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
> }
> @@ -527,7 +531,7 @@ void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name)
> if (!evm_key_loaded() || !evm_protected_xattr(xattr_name))
> return;
>
> - evm_reset_status(dentry->d_inode);
> + evm_reset_status(dentry->d_inode, IMA_CHANGE_XATTR);
>
> evm_update_evmxattr(dentry, xattr_name, NULL, 0);
> }
> @@ -600,6 +604,8 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
> if (!evm_key_loaded())
> return;
>
> + evm_reset_status(dentry->d_inode, IMA_CHANGE_ATTR);
> +
> if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))
> evm_update_evmxattr(dentry, NULL, NULL, 0);
> }
next prev parent reply other threads:[~2020-08-24 12:18 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200618160329.1263-2-roberto.sassu@huawei.com>
2020-06-18 16:04 ` [PATCH 06/11] evm: Allow setxattr() and setattr() if metadata digest won't change Roberto Sassu
2020-08-24 12:17 ` Mimi Zohar
2020-08-31 8:51 ` Roberto Sassu
2020-06-18 16:04 ` [PATCH 07/11] evm: Set IMA_CHANGE_XATTR/ATTR bit if EVM_ALLOW_METADATA_WRITES is set Roberto Sassu
2020-08-24 12:17 ` Mimi Zohar [this message]
2020-09-01 9:08 ` Roberto Sassu
2020-09-01 11:05 ` Mimi Zohar
2020-09-01 11:41 ` Roberto Sassu
2020-09-01 12:55 ` Mimi Zohar
2020-06-18 16:04 ` [PATCH 08/11] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:04 ` [PATCH 09/11] ima: Don't remove security.ima if file must not be appraised Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:04 ` [PATCH 10/11] ima: Don't ignore errors from crypto_shash_update() Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:06 ` [PATCH 11/11] ima: Remove semicolon at the end of ima_get_binary_runtime_size() Roberto Sassu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67cafcf63daf8e418871eb5302e7327ba851e253.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@google.com \
--cc=roberto.sassu@huawei.com \
--cc=silviu.vlasceanu@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).