From: "Mickaël Salaün" <mic@digikod.net>
To: linux-kernel@vger.kernel.org
Cc: "Mickaël Salaün" <mic@digikod.net>,
"Al Viro" <viro@zeniv.linux.org.uk>,
"James Morris" <jmorris@namei.org>,
"Jonathan Corbet" <corbet@lwn.net>,
"Kees Cook" <keescook@chromium.org>,
"Matthew Garrett" <mjg59@google.com>,
"Michael Kerrisk" <mtk.manpages@gmail.com>,
"Mickaël Salaün" <mickael.salaun@ssi.gouv.fr>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Philippe Trébuchet" <philippe.trebuchet@ssi.gouv.fr>,
"Shuah Khan" <shuah@kernel.org>,
"Thibaut Sautereau" <thibaut.sautereau@ssi.gouv.fr>,
"Vincent Strubel" <vincent.strubel@ssi.gouv.fr>,
"Yves-Alexis Perez" <yves-alexis.perez@ssi.gouv.fr>,
kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-fsdevel@vger.kernel.org
Subject: [RFC PATCH v1 0/5] Add support for O_MAYEXEC
Date: Wed, 12 Dec 2018 09:17:07 +0100 [thread overview]
Message-ID: <20181212081712.32347-1-mic@digikod.net> (raw)
Hi,
The goal of this patch series is to control script interpretation. A
new O_MAYEXEC flag used by sys_open() is added to enable userland script
interpreter to delegate to the kernel (and thus the system security
policy) the permission to interpret scripts or other files containing
what can be seen as commands.
The security policy is the responsibility of an LSM. A basic
system-wide policy is implemented with Yama and configurable through a
sysctl.
The initial idea come from CLIP OS and the original implementation has
been used for more than 10 years:
https://github.com/clipos-archive/clipos4_doc
An introduction to O_MAYEXEC was given at the Linux Security Summit
Europe 2018 - Linux Kernel Security Contributions by ANSSI:
https://www.youtube.com/watch?v=chNjCRtPKQY&t=17m15s
The "write xor execute" principle was explained at Kernel Recipes 2018 -
CLIP OS: a defense-in-depth OS:
https://www.youtube.com/watch?v=PjRE0uBtkHU&t=11m14s
This patch series can be applied on top of v4.20-rc6. This can be
tested with CONFIG_SECURITY_YAMA. I would really appreciate
constructive comments on this RFC.
Regards,
Mickaël Salaün (5):
fs: Add support for an O_MAYEXEC flag on sys_open()
fs: Add a MAY_EXECMOUNT flag to infer the noexec mount propertie
Yama: Enforces noexec mounts or file executability through O_MAYEXEC
selftest/yama: Add tests for O_MAYEXEC enforcing
doc: Add documentation for Yama's open_mayexec_enforce
Documentation/admin-guide/LSM/Yama.rst | 41 +++
MAINTAINERS | 1 +
fs/fcntl.c | 2 +-
fs/namei.c | 2 +
fs/open.c | 4 +
include/linux/fcntl.h | 2 +-
include/linux/fs.h | 4 +
include/uapi/asm-generic/fcntl.h | 3 +
security/yama/Kconfig | 3 +-
security/yama/yama_lsm.c | 82 +++++-
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/yama/.gitignore | 1 +
tools/testing/selftests/yama/Makefile | 19 ++
tools/testing/selftests/yama/config | 2 +
tools/testing/selftests/yama/test_omayexec.c | 276 +++++++++++++++++++
15 files changed, 439 insertions(+), 4 deletions(-)
create mode 100644 tools/testing/selftests/yama/.gitignore
create mode 100644 tools/testing/selftests/yama/Makefile
create mode 100644 tools/testing/selftests/yama/config
create mode 100644 tools/testing/selftests/yama/test_omayexec.c
--
2.20.0.rc2
next reply other threads:[~2018-12-12 8:34 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-12 8:17 Mickaël Salaün [this message]
2018-12-12 8:17 ` [RFC PATCH v1 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Mickaël Salaün
2018-12-12 14:43 ` Jan Kara
2018-12-12 14:43 ` Jan Kara
2018-12-12 14:43 ` Jan Kara
2018-12-12 17:09 ` Mickaël Salaün
2018-12-12 20:42 ` Mimi Zohar
2018-12-13 9:47 ` Matthew Bobrowski
2018-12-13 9:47 ` Matthew Bobrowski
2018-12-13 9:47 ` Matthew Bobrowski
2018-12-13 14:23 ` Mickaël Salaün
2019-04-15 18:47 ` Steve Grubb
2019-04-15 18:47 ` Steve Grubb
2019-04-16 11:49 ` Florian Weimer
2019-04-16 11:49 ` Florian Weimer
2019-04-16 15:34 ` Steve Grubb
2019-04-16 15:34 ` Steve Grubb
2019-04-17 10:01 ` Florian Weimer
2019-04-17 10:01 ` Florian Weimer
2019-04-17 15:04 ` Mickaël Salaün
2019-04-17 15:04 ` Mickaël Salaün
2019-04-17 14:55 ` Mickaël Salaün
2019-08-04 23:55 ` Andy Lutomirski
2019-08-04 23:55 ` Andy Lutomirski
2019-08-04 23:55 ` Andy Lutomirski
2019-08-06 16:40 ` Mickaël Salaün
2019-08-06 16:40 ` Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 2/5] fs: Add a MAY_EXECMOUNT flag to infer the noexec mount propertie Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 3/5] Yama: Enforces noexec mounts or file executability through O_MAYEXEC Mickaël Salaün
2018-12-12 14:28 ` Mickaël Salaün
2018-12-12 14:28 ` Mickaël Salaün
2018-12-12 17:09 ` Jann Horn
2018-12-13 14:49 ` Mickaël Salaün
2018-12-13 14:49 ` Mickaël Salaün
2019-01-03 11:17 ` Jann Horn
2019-01-08 13:29 ` Mickaël Salaün
2019-01-08 23:30 ` Kees Cook
2019-01-08 23:30 ` Kees Cook
2019-01-09 13:41 ` Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 4/5] selftest/yama: Add tests for O_MAYEXEC enforcing Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 5/5] doc: Add documentation for Yama's open_mayexec_enforce Mickaël Salaün
2018-12-12 16:29 ` [RFC PATCH v1 0/5] Add support for O_MAYEXEC Jordan Glover
2018-12-12 16:29 ` Jordan Glover
2018-12-12 17:01 ` Mickaël Salaün
2018-12-12 17:01 ` Mickaël Salaün
2018-12-12 19:51 ` James Morris
2018-12-12 19:51 ` James Morris
2018-12-12 20:13 ` Florian Weimer
2018-12-12 23:40 ` James Morris
2018-12-13 5:13 ` Florian Weimer
2018-12-13 14:57 ` Mickaël Salaün
2018-12-13 3:02 ` Matthew Wilcox
2018-12-13 3:02 ` Matthew Wilcox
2018-12-13 5:22 ` Florian Weimer
2018-12-13 5:22 ` Florian Weimer
2018-12-13 11:04 ` Mimi Zohar
2018-12-13 11:26 ` Florian Weimer
2018-12-13 11:26 ` Florian Weimer
2018-12-13 12:16 ` Mimi Zohar
2018-12-13 12:16 ` Mimi Zohar
2018-12-13 12:16 ` Matthew Wilcox
2018-12-13 12:16 ` Matthew Wilcox
2018-12-13 15:17 ` Mickaël Salaün
2018-12-13 17:13 ` Matthew Wilcox
2018-12-13 17:13 ` Matthew Wilcox
2018-12-13 17:36 ` Mickaël Salaün
2018-12-13 17:44 ` Matthew Wilcox
2018-12-13 17:44 ` Matthew Wilcox
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181212081712.32347-1-mic@digikod.net \
--to=mic@digikod.net \
--cc=corbet@lwn.net \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mickael.salaun@ssi.gouv.fr \
--cc=mjg59@google.com \
--cc=mtk.manpages@gmail.com \
--cc=philippe.trebuchet@ssi.gouv.fr \
--cc=shuah@kernel.org \
--cc=thibaut.sautereau@ssi.gouv.fr \
--cc=vincent.strubel@ssi.gouv.fr \
--cc=viro@zeniv.linux.org.uk \
--cc=yves-alexis.perez@ssi.gouv.fr \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.