Linux-Security-Module Archive on lore.kernel.org
 help / color / Atom feed
From: Casey Schaufler <casey@schaufler-ca.com>
To: Roberto Sassu <roberto.sassu@huawei.com>,
	zohar@linux.ibm.com, jmorris@namei.org, paul@paul-moore.com
Cc: linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, selinux@vger.kernel.org,
	reiserfs-devel@vger.kernel.org,
	Casey Schaufler <casey@schaufler-ca.com>
Subject: Re: [PATCH 0/5] evm: Prepare for moving to the LSM infrastructure
Date: Thu, 15 Apr 2021 13:43:39 -0700
Message-ID: <7659b8cf-71cc-33b5-dbf1-3eb1ff159fe6@schaufler-ca.com> (raw)
In-Reply-To: <20210415100435.18619-1-roberto.sassu@huawei.com>

On 4/15/2021 3:04 AM, Roberto Sassu wrote:
> This patch set depends on:
>
> https://lore.kernel.org/linux-integrity/20210409114313.4073-1-roberto.sassu@huawei.com/
> https://lore.kernel.org/linux-integrity/20210407105252.30721-1-roberto.sassu@huawei.com/
>
> One of the challenges that must be tackled to move IMA and EVM to the LSM
> infrastructure is to ensure that EVM is capable to correctly handle
> multiple stacked LSMs providing an xattr at file creation. At the moment,
> there are few issues that would prevent a correct integration. This patch
> set aims at solving them.
>
> From the LSM infrastructure side, the LSM stacking feature added the
> possibility of registering multiple implementations of the security hooks,
> that are called sequentially whenever someone calls the corresponding
> security hook. However, security_inode_init_security() and
> security_old_inode_init_security() are currently limited to support one
> xattr provided by LSM and one by EVM.

That is correct. At present the only two modules that provide extended
attributes are SELinux and Smack. The LSM infrastructure requires more
change, including change to security_inode_init_security(), before those
modules can be used together.

> In addition, using the call_int_hook() macro causes some issues. According
> to the documentation in include/linux/lsm_hooks.h, it is a legitimate case
> that an LSM returns -EOPNOTSUPP when it does not want to provide an xattr.
> However, the loop defined in the macro would stop calling subsequent LSMs
> if that happens. In the case of security_old_inode_init_security(), using
> the macro would also cause a memory leak due to replacing the *value
> pointer, if multiple LSMs provide an xattr.

As there is no case where there will be multiple providers of hooks for
inode_init_security this isn't an issue.

> From EVM side, the first operation to be done is to change the definition
> of evm_inode_init_security() to be compatible with the security hook
> definition. Unfortunately, the current definition does not provide enough
> information for EVM, as it must have visibility of all xattrs provided by
> LSMs to correctly calculate the HMAC. This patch set changes the security
> hook definition by adding the full array of xattr as a parameter.

Why do you want to call evm_inode_init_security() as a regular LSM hook?
Except for the names evm_inode_init_security() and selinux_inode_init_security()
have nothing in common. They do very different things and require different
data, as comes out in the patches.

There are evm functions that could be implemented as LSM hooks. I don't think
this is one of them. There's no point in going overboard.

> Secondly, EVM must know how many elements are in the xattr array. It seems
> that it is not necessary to add another parameter, as all filesystems that
> define an initxattr function, expect that the last element of the array 
is
> one with the name field set to NULL. EVM reuses the same assumption.
>
> This patch set has been tested by introducing several instances of a
> TestLSM (some providing an xattr, some not, one with a wrong implementation
> to see how the LSM infrastructure handles it). The patch is not included
> in this set but it is available here:
>
> https://github.com/robertosassu/linux/commit/0370ff0fbc16e5d63489836a958e65d697f956db
>
> The test, added to ima-evm-utils, is available here:
>
> https://github.com/robertosassu/ima-evm-utils/blob/evm-multiple-lsms-v1-devel-v1/tests/evm_multiple_lsms.test
>
> The test takes a UML kernel built by Travis and launches it several times,
> each time with a different combination of LSMs. After boot, it first checks
> that there is an xattr for each LSM providing it, and then calculates the
> HMAC in user space and compares it with the HMAC calculated by EVM in
> kernel space.
>
> A test report can be obtained here:
>
> https://www.travis-ci.com/github/robertosassu/ima-evm-utils/jobs/498699540
>
> Lastly, running the test on reiserfs to check
> security_old_inode_init_security(), some issues have been discovered: a
> free of xattr->name which is not correct after commit 9548906b2bb7 ('xattr:
> Constify ->name member of "struct xattr"'), and a misalignment with
> security_inode_init_security() (the old version expects the full xattr name
> with the security. prefix, the new version just the suffix). The last issue
> has not been fixed yet.
>
> Roberto Sassu (5):
>   xattr: Complete constify ->name member of "struct xattr"
>   security: Support multiple LSMs implementing the inode_init_security
>     hook
>   security: Pass xattrs allocated by LSMs to the inode_init_security
>     hook
>   evm: Align evm_inode_init_security() definition with LSM
>     infrastructure
>   evm: Support multiple LSMs providing an xattr
>
>  fs/reiserfs/xattr_security.c        |  2 -
>  include/linux/evm.h                 | 21 ++++---
>  include/linux/lsm_hook_defs.h       |  2 +-
>  include/linux/lsm_hooks.h           |  5 +-
>  security/integrity/evm/evm.h        |  2 +
>  security/integrity/evm/evm_crypto.c |  9 ++-
>  security/integrity/evm/evm_main.c   | 35 +++++++----
>  security/security.c                 | 95 +++++++++++++++++++++++------
>  security/selinux/hooks.c            |  3 +-
>  security/smack/smack_lsm.c          |  4 +-
>  10 files changed, 135 insertions(+), 43 deletions(-)
>


  parent reply index

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-15 10:04 Roberto Sassu
2021-04-15 10:04 ` [PATCH 1/5] xattr: Complete constify ->name member of "struct xattr" Roberto Sassu
2021-04-15 11:20   ` Tetsuo Handa
2021-04-15 12:25     ` Roberto Sassu
2021-04-15 10:04 ` [PATCH 2/5] security: Support multiple LSMs implementing the inode_init_security hook Roberto Sassu
2021-04-15 10:04 ` [PATCH 3/5] security: Pass xattrs allocated by LSMs to " Roberto Sassu
2021-04-15 10:04 ` [PATCH 4/5] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
2021-04-15 10:04 ` [PATCH 5/5] evm: Support multiple LSMs providing an xattr Roberto Sassu
2021-04-15 20:43 ` Casey Schaufler [this message]
2021-04-16 16:37   ` [PATCH 0/5] evm: Prepare for moving to the LSM infrastructure Roberto Sassu
2021-04-16 21:25     ` Casey Schaufler
2021-04-20 16:09       ` Roberto Sassu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=7659b8cf-71cc-33b5-dbf1-3eb1ff159fe6@schaufler-ca.com \
    --to=casey@schaufler-ca.com \
    --cc=jmorris@namei.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=paul@paul-moore.com \
    --cc=reiserfs-devel@vger.kernel.org \
    --cc=roberto.sassu@huawei.com \
    --cc=selinux@vger.kernel.org \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org
	public-inbox-index linux-security-module

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git