linux-unionfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* Re: [RFC PATCH] ima: differentiate overlay, pivot_root, and other pathnames
       [not found] <CAJQqANe-SFvPEEQcQrGUsn9n1aFybCOQaofvnmS+qZGvnNh7nQ@mail.gmail.com>
@ 2021-11-10 17:39 ` Mimi Zohar
  0 siblings, 0 replies; 2+ messages in thread
From: Mimi Zohar @ 2021-11-10 17:39 UTC (permalink / raw)
  To: Michael Peters
  Cc: amir73il, linux-fsdevel, linux-integrity, linux-kernel,
	linux-unionfs, miklos

On Wed, 2021-11-10 at 10:28 -0500, Michael Peters wrote:

> This looks good, but would be even better if the flag that controlled
> this was settable in the ima_policy. That's much easier to work with
> in a lot of DevOps toolchains and pipelines and is similar to how the
> other ima configuration is done.

Thanks, Michael.  Agreed, which is one of the reasons for posting this
patch as an RFC.  The other reason is that it is an incomplete
solution, since it doesn't address mount namespaces.  Any suggestions
for addressing mount namespaces would be appreciated. Assuming there is
a benefit for a partial solution, I'll add the per policy rule support.

thanks,

Mimi


^ permalink raw reply	[flat|nested] 2+ messages in thread

* [RFC PATCH] ima: differentiate overlay, pivot_root, and other pathnames
@ 2021-11-08 17:01 Mimi Zohar
  0 siblings, 0 replies; 2+ messages in thread
From: Mimi Zohar @ 2021-11-08 17:01 UTC (permalink / raw)
  To: linux-integrity
  Cc: Mimi Zohar, Miklos Szeredi, Amir Goldstein, linux-fsdevel,
	linux-kernel, linux-unionfs

Relative file pathnames are included in the IMA measurement list making
it difficult to differentiate files.  Permit replacing the relative
pathname with the (raw) full pathname in the measurement list.

Define a new module param named "ima.rawpath".

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
comment: this change does not address the simple "unshare -m" case
without pivot_root.

 .../admin-guide/kernel-parameters.txt          |  7 +++++++
 security/integrity/ima/ima_api.c               | 18 +++++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 91ba391f9b32..d49a5edcd3c3 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1890,6 +1890,13 @@
 			different crypto accelerators. This option can be used
 			to achieve best performance for particular HW.
 
+	ima.rawpath=	[IMA]
+			Format: <bool>
+			Default: 0
+			This parameter controls whether the IMA measurement
+			list contains the relative or raw full file pathnames
+			in the IMA measurement list.
+
 	init=		[KNL]
 			Format: <full_path>
 			Run specified binary instead of /sbin/init as init
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index a64fb0130b01..42c6ff7056e6 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -9,14 +9,19 @@
  *	appraise_measurement, store_measurement and store_template.
  */
 #include <linux/slab.h>
+#include <linux/moduleparam.h>
 #include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/fs_struct.h>
 #include <linux/xattr.h>
 #include <linux/evm.h>
 #include <linux/iversion.h>
 
 #include "ima.h"
 
+static bool rawpath_enabled;
+module_param_named(rawpath, rawpath_enabled, bool, 0);
+
 /*
  * ima_free_template_entry - free an existing template entry
  */
@@ -390,11 +395,22 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
  */
 const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
 {
+	struct dentry *dentry = NULL;
 	char *pathname = NULL;
 
 	*pathbuf = __getname();
 	if (*pathbuf) {
-		pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
+		if (!rawpath_enabled) {
+			pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
+		} else {
+			/* Use union/overlay full pathname */
+			if (unlikely(path->dentry->d_flags & DCACHE_OP_REAL))
+				dentry = d_real(path->dentry, NULL);
+			else
+				dentry = path->dentry;
+			pathname = dentry_path_raw(dentry, *pathbuf, PATH_MAX);
+		}
+
 		if (IS_ERR(pathname)) {
 			__putname(*pathbuf);
 			*pathbuf = NULL;
-- 
2.27.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-11-10 17:39 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <CAJQqANe-SFvPEEQcQrGUsn9n1aFybCOQaofvnmS+qZGvnNh7nQ@mail.gmail.com>
2021-11-10 17:39 ` [RFC PATCH] ima: differentiate overlay, pivot_root, and other pathnames Mimi Zohar
2021-11-08 17:01 Mimi Zohar

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).