| Message ID | 1710560151-28904-17-git-send-email-wufan@linux.microsoft.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | Integrity Policy Enforcement LSM (IPE) | expand |
On Mar 15, 2024 Fan Wu <wufan@linux.microsoft.com> wrote: > > This patch introduces a new hook to save inode's integrity > data. For example, for fsverity enabled files, LSMs can use this hook to save > the verified fsverity builtin signature into the inode's security blob, > and LSMs can make access decisions based on the data inside the signature, > like the signer certificate. > > Signed-off-by: Fan Wu <wufan@linux.microsoft.com> > > -- > v1-v14: > + Not present > > v15: > + Introduced > > --- > include/linux/lsm_hook_defs.h | 3 +++ > include/linux/security.h | 10 ++++++++++ > security/security.c | 28 ++++++++++++++++++++++++++++ > 3 files changed, 41 insertions(+) > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h > index 6808ae763913..c88587fc3691 100644 > --- a/include/linux/lsm_hook_defs.h > +++ b/include/linux/lsm_hook_defs.h > @@ -177,6 +177,9 @@ LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, > LSM_HOOK(void, LSM_RET_VOID, inode_getsecid, struct inode *inode, u32 *secid) > LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) > LSM_HOOK(int, -EOPNOTSUPP, inode_copy_up_xattr, const char *name) > +LSM_HOOK(int, 0, inode_setintegrity, struct inode *inode, > + enum lsm_intgr_type type, const void *value, size_t size) > + > LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, > struct kernfs_node *kn) > LSM_HOOK(int, 0, file_permission, struct file *file, int mask) > diff --git a/include/linux/security.h b/include/linux/security.h > index 60b40b523d57..0885866b261e 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -405,6 +405,9 @@ int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer > void security_inode_getsecid(struct inode *inode, u32 *secid); > int security_inode_copy_up(struct dentry *src, struct cred **new); > int security_inode_copy_up_xattr(const char *name); > +int security_inode_setintegrity(struct inode *inode, > + enum lsm_intgr_type type, const void *value, > + size_t size); > int security_kernfs_init_security(struct kernfs_node *kn_dir, > struct kernfs_node *kn); > int security_file_permission(struct file *file, int mask); > @@ -1021,6 +1024,13 @@ static inline int security_inode_copy_up(struct dentry *src, struct cred **new) > return 0; > } > > +static inline int security_inode_setintegrity(struct inode *inode, > + enum lsm_intgr_type, type, > + const void *value, size_t size) > +{ > + return 0; > +} > + > static inline int security_kernfs_init_security(struct kernfs_node *kn_dir, > struct kernfs_node *kn) > { > diff --git a/security/security.c b/security/security.c > index 8d88529ac904..c5d426d084ab 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -2681,6 +2681,34 @@ int security_inode_copy_up_xattr(const char *name) > } > EXPORT_SYMBOL(security_inode_copy_up_xattr); > > +/** > + * security_inode_setintegrity() - Set the inode's integrity data > + * @inode: inode > + * @type: type of integrity, e.g. hash digest, signature, etc > + * @value: the integrity value > + * @size: size of the integrity value > + * > + * Register a verified integrity measurement of a inode with the LSM. > + * > + * Return: Returns 0 on success, negative values on failure. > + */ > +int security_inode_setintegrity(struct inode *inode, > + enum lsm_intgr_type type, const void *value, > + size_t size) > +{ > + int rc = 0; > + struct security_hook_list *p; > + > + hlist_for_each_entry(p, &security_hook_heads.inode_setintegrity, list) { > + rc = p->hook.inode_setintegrity(inode, type, value, size); > + if (rc) > + return rc; > + } > + > + return LSM_RET_DEFAULT(inode_setintegrity); > +} > +EXPORT_SYMBOL(security_inode_setintegrity); Same as the block device variant of this hook, we should convert this to use the call_int_hook() macro unless there is a strong reason to leave it open coded. > /** > * security_kernfs_init_security() - Init LSM context for a kernfs node > * @kn_dir: parent kernfs node > -- > 2.44.0 -- paul-moore.com
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 6808ae763913..c88587fc3691 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -177,6 +177,9 @@ LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, LSM_HOOK(void, LSM_RET_VOID, inode_getsecid, struct inode *inode, u32 *secid) LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) LSM_HOOK(int, -EOPNOTSUPP, inode_copy_up_xattr, const char *name) +LSM_HOOK(int, 0, inode_setintegrity, struct inode *inode, + enum lsm_intgr_type type, const void *value, size_t size) + LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, struct kernfs_node *kn) LSM_HOOK(int, 0, file_permission, struct file *file, int mask) diff --git a/include/linux/security.h b/include/linux/security.h index 60b40b523d57..0885866b261e 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -405,6 +405,9 @@ int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer void security_inode_getsecid(struct inode *inode, u32 *secid); int security_inode_copy_up(struct dentry *src, struct cred **new); int security_inode_copy_up_xattr(const char *name); +int security_inode_setintegrity(struct inode *inode, + enum lsm_intgr_type type, const void *value, + size_t size); int security_kernfs_init_security(struct kernfs_node *kn_dir, struct kernfs_node *kn); int security_file_permission(struct file *file, int mask); @@ -1021,6 +1024,13 @@ static inline int security_inode_copy_up(struct dentry *src, struct cred **new) return 0; } +static inline int security_inode_setintegrity(struct inode *inode, + enum lsm_intgr_type, type, + const void *value, size_t size) +{ + return 0; +} + static inline int security_kernfs_init_security(struct kernfs_node *kn_dir, struct kernfs_node *kn) { diff --git a/security/security.c b/security/security.c index 8d88529ac904..c5d426d084ab 100644 --- a/security/security.c +++ b/security/security.c @@ -2681,6 +2681,34 @@ int security_inode_copy_up_xattr(const char *name) } EXPORT_SYMBOL(security_inode_copy_up_xattr); +/** + * security_inode_setintegrity() - Set the inode's integrity data + * @inode: inode + * @type: type of integrity, e.g. hash digest, signature, etc + * @value: the integrity value + * @size: size of the integrity value + * + * Register a verified integrity measurement of a inode with the LSM. + * + * Return: Returns 0 on success, negative values on failure. + */ +int security_inode_setintegrity(struct inode *inode, + enum lsm_intgr_type type, const void *value, + size_t size) +{ + int rc = 0; + struct security_hook_list *p; + + hlist_for_each_entry(p, &security_hook_heads.inode_setintegrity, list) { + rc = p->hook.inode_setintegrity(inode, type, value, size); + if (rc) + return rc; + } + + return LSM_RET_DEFAULT(inode_setintegrity); +} +EXPORT_SYMBOL(security_inode_setintegrity); + /** * security_kernfs_init_security() - Init LSM context for a kernfs node * @kn_dir: parent kernfs node
This patch introduces a new hook to save inode's integrity data. For example, for fsverity enabled files, LSMs can use this hook to save the verified fsverity builtin signature into the inode's security blob, and LSMs can make access decisions based on the data inside the signature, like the signer certificate. Signed-off-by: Fan Wu <wufan@linux.microsoft.com> -- v1-v14: + Not present v15: + Introduced --- include/linux/lsm_hook_defs.h | 3 +++ include/linux/security.h | 10 ++++++++++ security/security.c | 28 ++++++++++++++++++++++++++++ 3 files changed, 41 insertions(+)