From: Fan Wu <wufan@linux.microsoft.com> To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-block@vger.kernel.org, dm-devel@redhat.com, audit@vger.kernel.org, roberto.sassu@huawei.com, linux-kernel@vger.kernel.org, Fan Wu <wufan@linux.microsoft.com>, Deven Bowers <deven.desai@linux.microsoft.com> Subject: [RFC PATCH v11 15/19] fsverity: consume builtin signature via LSM hook Date: Wed, 4 Oct 2023 15:09:42 -0700 [thread overview] Message-ID: <1696457386-3010-16-git-send-email-wufan@linux.microsoft.com> (raw) In-Reply-To: <1696457386-3010-1-git-send-email-wufan@linux.microsoft.com> fsverity represents a mechanism to support both integrity and authenticity protection of a file, supporting both signed and unsigned digests. An LSM which controls access to a resource based on authenticity and integrity of said resource, can then use this data to make an informed decision on the authorization (provided by the LSM's policy) of said claim. This effectively allows the extension of a policy enforcement layer in LSM for fsverity, allowing for more granular control of how a particular authenticity claim can be used. For example, "all (built-in) signed fsverity files should be allowed to execute, but only these hashes are allowed to be loaded as kernel modules". This enforcement must be done in kernel space, as a userspace only solution would fail a simple litmus test: Download a self-contained malicious binary that never touches the userspace stack. This binary would still be able to execute. Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com> Signed-off-by: Fan Wu <wufan@linux.microsoft.com> --- v1-v6: + Not present v7: Introduced v8: + Split fs/verity/ changes and security/ changes into separate patches + Change signature of fsverity_create_info to accept non-const inode + Change signature of fsverity_verify_signature to accept non-const inode + Don't cast-away const from inode. + Digest functionality dropped in favor of: ("fs-verity: define a function to return the integrity protected file digest") + Reworded commit description and title to match changes. + Fix a bug wherein no LSM implements the particular fsverity @name (or LSM is disabled), and returns -EOPNOTSUPP, causing errors. v9: + No changes v10: + Rename the signature blob key + Cleanup redundant code + Make the hook call depends on CONFIG_FS_VERITY_BUILTIN_SIGNATURES v11: + No changes --- fs/verity/fsverity_private.h | 2 +- fs/verity/open.c | 26 +++++++++++++++++++++++++- include/linux/fsverity.h | 2 ++ 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h index d071a6e32581..4a82716e852f 100644 --- a/fs/verity/fsverity_private.h +++ b/fs/verity/fsverity_private.h @@ -108,7 +108,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, unsigned int log_blocksize, const u8 *salt, size_t salt_size); -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc); void fsverity_set_info(struct inode *inode, struct fsverity_info *vi); diff --git a/fs/verity/open.c b/fs/verity/open.c index 6c31a871b84b..5b48e2c39086 100644 --- a/fs/verity/open.c +++ b/fs/verity/open.c @@ -8,6 +8,7 @@ #include "fsverity_private.h" #include <linux/mm.h> +#include <linux/security.h> #include <linux/slab.h> static struct kmem_cache *fsverity_info_cachep; @@ -172,12 +173,28 @@ static int compute_file_digest(const struct fsverity_hash_alg *hash_alg, return err; } +#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES +static int fsverity_inode_setsecurity(struct inode *inode, + struct fsverity_descriptor *desc) +{ + return security_inode_setsecurity(inode, FS_VERITY_INODE_SEC_NAME, + desc->signature, + le32_to_cpu(desc->sig_size), 0); +} +#else +static inline int fsverity_inode_setsecurity(struct inode *inode, + struct fsverity_descriptor *desc) +{ + return 0; +} +#endif /* CONFIG_IPE_PROP_FS_VERITY*/ + /* * Create a new fsverity_info from the given fsverity_descriptor (with optional * appended builtin signature), and check the signature if present. The * fsverity_descriptor must have already undergone basic validation. */ -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc) { struct fsverity_info *vi; @@ -242,6 +259,13 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode, spin_lock_init(&vi->hash_page_init_lock); } + err = fsverity_inode_setsecurity(inode, desc); + if (err == -EOPNOTSUPP) + err = 0; + + if (err) + goto fail; + return vi; fail: diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h index 1eb7eae580be..9666721baf15 100644 --- a/include/linux/fsverity.h +++ b/include/linux/fsverity.h @@ -319,4 +319,6 @@ static inline int fsverity_prepare_setattr(struct dentry *dentry, return 0; } +#define FS_VERITY_INODE_SEC_NAME "fsverity.builtin-sig" + #endif /* _LINUX_FSVERITY_H */ -- 2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: Fan Wu <wufan@linux.microsoft.com> To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Cc: dm-devel@redhat.com, linux-doc@vger.kernel.org, Deven Bowers <deven.desai@linux.microsoft.com>, roberto.sassu@huawei.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, audit@vger.kernel.org, linux-fscrypt@vger.kernel.org, Fan Wu <wufan@linux.microsoft.com>, linux-integrity@vger.kernel.org Subject: [dm-devel] [RFC PATCH v11 15/19] fsverity: consume builtin signature via LSM hook Date: Wed, 4 Oct 2023 15:09:42 -0700 [thread overview] Message-ID: <1696457386-3010-16-git-send-email-wufan@linux.microsoft.com> (raw) In-Reply-To: <1696457386-3010-1-git-send-email-wufan@linux.microsoft.com> fsverity represents a mechanism to support both integrity and authenticity protection of a file, supporting both signed and unsigned digests. An LSM which controls access to a resource based on authenticity and integrity of said resource, can then use this data to make an informed decision on the authorization (provided by the LSM's policy) of said claim. This effectively allows the extension of a policy enforcement layer in LSM for fsverity, allowing for more granular control of how a particular authenticity claim can be used. For example, "all (built-in) signed fsverity files should be allowed to execute, but only these hashes are allowed to be loaded as kernel modules". This enforcement must be done in kernel space, as a userspace only solution would fail a simple litmus test: Download a self-contained malicious binary that never touches the userspace stack. This binary would still be able to execute. Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com> Signed-off-by: Fan Wu <wufan@linux.microsoft.com> --- v1-v6: + Not present v7: Introduced v8: + Split fs/verity/ changes and security/ changes into separate patches + Change signature of fsverity_create_info to accept non-const inode + Change signature of fsverity_verify_signature to accept non-const inode + Don't cast-away const from inode. + Digest functionality dropped in favor of: ("fs-verity: define a function to return the integrity protected file digest") + Reworded commit description and title to match changes. + Fix a bug wherein no LSM implements the particular fsverity @name (or LSM is disabled), and returns -EOPNOTSUPP, causing errors. v9: + No changes v10: + Rename the signature blob key + Cleanup redundant code + Make the hook call depends on CONFIG_FS_VERITY_BUILTIN_SIGNATURES v11: + No changes --- fs/verity/fsverity_private.h | 2 +- fs/verity/open.c | 26 +++++++++++++++++++++++++- include/linux/fsverity.h | 2 ++ 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h index d071a6e32581..4a82716e852f 100644 --- a/fs/verity/fsverity_private.h +++ b/fs/verity/fsverity_private.h @@ -108,7 +108,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, unsigned int log_blocksize, const u8 *salt, size_t salt_size); -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc); void fsverity_set_info(struct inode *inode, struct fsverity_info *vi); diff --git a/fs/verity/open.c b/fs/verity/open.c index 6c31a871b84b..5b48e2c39086 100644 --- a/fs/verity/open.c +++ b/fs/verity/open.c @@ -8,6 +8,7 @@ #include "fsverity_private.h" #include <linux/mm.h> +#include <linux/security.h> #include <linux/slab.h> static struct kmem_cache *fsverity_info_cachep; @@ -172,12 +173,28 @@ static int compute_file_digest(const struct fsverity_hash_alg *hash_alg, return err; } +#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES +static int fsverity_inode_setsecurity(struct inode *inode, + struct fsverity_descriptor *desc) +{ + return security_inode_setsecurity(inode, FS_VERITY_INODE_SEC_NAME, + desc->signature, + le32_to_cpu(desc->sig_size), 0); +} +#else +static inline int fsverity_inode_setsecurity(struct inode *inode, + struct fsverity_descriptor *desc) +{ + return 0; +} +#endif /* CONFIG_IPE_PROP_FS_VERITY*/ + /* * Create a new fsverity_info from the given fsverity_descriptor (with optional * appended builtin signature), and check the signature if present. The * fsverity_descriptor must have already undergone basic validation. */ -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc) { struct fsverity_info *vi; @@ -242,6 +259,13 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode, spin_lock_init(&vi->hash_page_init_lock); } + err = fsverity_inode_setsecurity(inode, desc); + if (err == -EOPNOTSUPP) + err = 0; + + if (err) + goto fail; + return vi; fail: diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h index 1eb7eae580be..9666721baf15 100644 --- a/include/linux/fsverity.h +++ b/include/linux/fsverity.h @@ -319,4 +319,6 @@ static inline int fsverity_prepare_setattr(struct dentry *dentry, return 0; } +#define FS_VERITY_INODE_SEC_NAME "fsverity.builtin-sig" + #endif /* _LINUX_FSVERITY_H */ -- 2.25.1 -- dm-devel mailing list dm-devel@redhat.com https://listman.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2023-10-04 22:10 UTC|newest] Thread overview: 105+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-10-04 22:09 [RFC PATCH v11 00/19] Integrity Policy Enforcement LSM (IPE) Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 01/19] security: add ipe lsm Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 02/19] ipe: add policy parser Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC v11 2/19] " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-10-25 22:45 ` Fan Wu 2023-10-25 22:45 ` Fan Wu 2023-10-26 21:36 ` Paul Moore 2023-10-26 21:36 ` Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 03/19] ipe: add evaluation loop Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC v11 3/19] " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-10-26 0:15 ` Fan Wu 2023-10-26 0:15 ` Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 04/19] ipe: add LSM hooks on execution and kernel read Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-05 8:24 ` kernel test robot 2023-10-24 3:52 ` [PATCH RFC v11 4/19] " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 05/19] ipe: introduce 'boot_verified' as a trust provider Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC v11 5/19] " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-10-26 21:33 ` Fan Wu 2023-10-26 21:33 ` Fan Wu 2023-10-26 22:12 ` Paul Moore 2023-10-26 22:12 ` Paul Moore 2023-11-02 22:46 ` Fan Wu 2023-11-03 22:15 ` Paul Moore 2023-11-03 22:30 ` Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 06/19] security: add new securityfs delete function Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 07/19] ipe: add userspace interface Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-05 10:32 ` kernel test robot 2023-10-24 3:52 ` [PATCH RFC v11 7/19] " Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 08/19] uapi|audit|ipe: add ipe auditing support Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-05 13:00 ` kernel test robot 2023-10-24 3:52 ` [PATCH RFC v11 8/19] " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 22:55 ` Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 09/19] ipe: add permissive toggle Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC v11 9/19] " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 22:56 ` Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 10/19] block|security: add LSM blob to block_device Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 11/19] dm verity: set DM_TARGET_SINGLETON feature flag Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 0:40 ` Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 12/19] dm: add finalize hook to target_type Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 0:41 ` Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 13/19] dm verity: consume root hash digest and signature data via LSM hook Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 0:41 ` Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 14/19] ipe: add support for dm-verity as a trust provider Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 22:40 ` Fan Wu 2023-10-04 22:09 ` Fan Wu [this message] 2023-10-04 22:09 ` [dm-devel] [RFC PATCH v11 15/19] fsverity: consume builtin signature via LSM hook Fan Wu 2023-10-05 2:27 ` Eric Biggers 2023-10-05 2:27 ` [dm-devel] " Eric Biggers 2023-10-05 2:49 ` Fan Wu 2023-10-05 2:49 ` Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 0:40 ` Paul Moore 2023-11-02 2:53 ` Eric Biggers 2023-11-02 15:42 ` Paul Moore 2023-11-02 19:33 ` Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 16/19] ipe: enable support for fs-verity as a trust provider Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-04 23:58 ` Randy Dunlap 2023-10-04 23:58 ` [dm-devel] " Randy Dunlap 2023-10-05 2:45 ` Fan Wu 2023-10-05 2:45 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-10-04 22:09 ` [RFC PATCH v11 17/19] scripts: add boot policy generation program Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 23:09 ` Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 18/19] ipe: kunit test for parser Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu 2023-10-24 3:52 ` [PATCH RFC " Paul Moore 2023-10-24 3:52 ` Paul Moore 2023-11-02 23:11 ` Fan Wu 2023-10-04 22:09 ` [RFC PATCH v11 19/19] documentation: add ipe documentation Fan Wu 2023-10-04 22:09 ` [dm-devel] " Fan Wu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1696457386-3010-16-git-send-email-wufan@linux.microsoft.com \ --to=wufan@linux.microsoft.com \ --cc=agk@redhat.com \ --cc=audit@vger.kernel.org \ --cc=axboe@kernel.dk \ --cc=corbet@lwn.net \ --cc=deven.desai@linux.microsoft.com \ --cc=dm-devel@redhat.com \ --cc=ebiggers@kernel.org \ --cc=eparis@redhat.com \ --cc=jmorris@namei.org \ --cc=linux-block@vger.kernel.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-fscrypt@vger.kernel.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=paul@paul-moore.com \ --cc=roberto.sassu@huawei.com \ --cc=serge@hallyn.com \ --cc=snitzer@kernel.org \ --cc=tytso@mit.edu \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.