| Message ID | 1710560151-28904-6-git-send-email-wufan@linux.microsoft.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | Integrity Policy Enforcement LSM (IPE) | expand |
On 3/15/2024 8:35 PM, Fan Wu wrote: > This patch introduces a new hook to notify security system that the > content of initramfs has been unpacked into the rootfs. > > Upon receiving this notification, the security system can activate > a policy to allow only files that originated from the initramfs to > execute or load into kernel during the early stages of booting. > > This approach is crucial for minimizing the attack surface by > ensuring that only trusted files from the initramfs are operational > in the critical boot phase. > > Signed-off-by: Fan Wu <wufan@linux.microsoft.com> > > --- > v1-v11: > + Not present > > v12: > + Introduced > > v13: > + Rename the hook name to initramfs_populated() > > v14: > + No changes > > v15: > + No changes > --- > include/linux/lsm_hook_defs.h | 2 ++ > include/linux/security.h | 8 ++++++++ > init/initramfs.c | 3 +++ > security/security.c | 10 ++++++++++ > 4 files changed, 23 insertions(+) > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h > index 334e00efbde4..7db99ae75651 100644 > --- a/include/linux/lsm_hook_defs.h > +++ b/include/linux/lsm_hook_defs.h > @@ -450,3 +450,5 @@ LSM_HOOK(int, 0, uring_override_creds, const struct cred *new) > LSM_HOOK(int, 0, uring_sqpoll, void) > LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd) > #endif /* CONFIG_IO_URING */ > + > +LSM_HOOK(void, LSM_RET_VOID, initramfs_populated, void) This is an awfully expensive way to set a flag. Adding a LSM hook list isn't free. Isn't there a way to capture this state change through one of the mount hooks? > diff --git a/include/linux/security.h b/include/linux/security.h > index 41a8f667bdfa..14fff542f2e3 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -2255,4 +2255,12 @@ static inline int security_uring_cmd(struct io_uring_cmd *ioucmd) > #endif /* CONFIG_SECURITY */ > #endif /* CONFIG_IO_URING */ > > +#ifdef CONFIG_SECURITY > +extern void security_initramfs_populated(void); > +#else > +static inline void security_initramfs_populated(void) > +{ > +} > +#endif /* CONFIG_SECURITY */ > + > #endif /* ! __LINUX_SECURITY_H */ > diff --git a/init/initramfs.c b/init/initramfs.c > index da79760b8be3..cc9115117896 100644 > --- a/init/initramfs.c > +++ b/init/initramfs.c > @@ -17,6 +17,7 @@ > #include <linux/namei.h> > #include <linux/init_syscalls.h> > #include <linux/umh.h> > +#include <linux/security.h> > > #include "do_mounts.h" > > @@ -719,6 +720,8 @@ static void __init do_populate_rootfs(void *unused, async_cookie_t cookie) > #endif > } > > + security_initramfs_populated(); > + > done: > /* > * If the initrd region is overlapped with crashkernel reserved region, > diff --git a/security/security.c b/security/security.c > index 287bfac6b471..b10230c51c0b 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -5675,3 +5675,13 @@ int security_uring_cmd(struct io_uring_cmd *ioucmd) > return call_int_hook(uring_cmd, ioucmd); > } > #endif /* CONFIG_IO_URING */ > + > +/** > + * security_initramfs_populated() - Notify LSMs that initramfs has been loaded > + * > + * Tells the LSMs the initramfs has been unpacked into the rootfs. > + */ > +void security_initramfs_populated(void) > +{ > + call_void_hook(initramfs_populated); > +}
On Sun, Mar 17, 2024 at 8:29 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > On 3/15/2024 8:35 PM, Fan Wu wrote: > > This patch introduces a new hook to notify security system that the > > content of initramfs has been unpacked into the rootfs. > > > > Upon receiving this notification, the security system can activate > > a policy to allow only files that originated from the initramfs to > > execute or load into kernel during the early stages of booting. > > > > This approach is crucial for minimizing the attack surface by > > ensuring that only trusted files from the initramfs are operational > > in the critical boot phase. > > > > Signed-off-by: Fan Wu <wufan@linux.microsoft.com> > > > > --- > > v1-v11: > > + Not present > > > > v12: > > + Introduced > > > > v13: > > + Rename the hook name to initramfs_populated() > > > > v14: > > + No changes > > > > v15: > > + No changes > > --- > > include/linux/lsm_hook_defs.h | 2 ++ > > include/linux/security.h | 8 ++++++++ > > init/initramfs.c | 3 +++ > > security/security.c | 10 ++++++++++ > > 4 files changed, 23 insertions(+) > > > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h > > index 334e00efbde4..7db99ae75651 100644 > > --- a/include/linux/lsm_hook_defs.h > > +++ b/include/linux/lsm_hook_defs.h > > @@ -450,3 +450,5 @@ LSM_HOOK(int, 0, uring_override_creds, const struct cred *new) > > LSM_HOOK(int, 0, uring_sqpoll, void) > > LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd) > > #endif /* CONFIG_IO_URING */ > > + > > +LSM_HOOK(void, LSM_RET_VOID, initramfs_populated, void) > > This is an awfully expensive way to set a flag. Adding a LSM hook list > isn't free. Isn't there a way to capture this state change through one of > the mount hooks? Unfortunately no, the initramfs isn't mounted like a traditional filesystem, it is "populated" by unpacking the cpio into the initramfs at early boot. This LSM hook should be called exactly once during boot, and the performance impact should be minimal; I should also be wildly more performant than earlier revisions of this patchset that required grabbing a single spinlock on every file access. Of course if you have an idea on how this could be done differently/better I think we're all open to new ideas ...
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 334e00efbde4..7db99ae75651 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -450,3 +450,5 @@ LSM_HOOK(int, 0, uring_override_creds, const struct cred *new) LSM_HOOK(int, 0, uring_sqpoll, void) LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd) #endif /* CONFIG_IO_URING */ + +LSM_HOOK(void, LSM_RET_VOID, initramfs_populated, void) diff --git a/include/linux/security.h b/include/linux/security.h index 41a8f667bdfa..14fff542f2e3 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -2255,4 +2255,12 @@ static inline int security_uring_cmd(struct io_uring_cmd *ioucmd) #endif /* CONFIG_SECURITY */ #endif /* CONFIG_IO_URING */ +#ifdef CONFIG_SECURITY +extern void security_initramfs_populated(void); +#else +static inline void security_initramfs_populated(void) +{ +} +#endif /* CONFIG_SECURITY */ + #endif /* ! __LINUX_SECURITY_H */ diff --git a/init/initramfs.c b/init/initramfs.c index da79760b8be3..cc9115117896 100644 --- a/init/initramfs.c +++ b/init/initramfs.c @@ -17,6 +17,7 @@ #include <linux/namei.h> #include <linux/init_syscalls.h> #include <linux/umh.h> +#include <linux/security.h> #include "do_mounts.h" @@ -719,6 +720,8 @@ static void __init do_populate_rootfs(void *unused, async_cookie_t cookie) #endif } + security_initramfs_populated(); + done: /* * If the initrd region is overlapped with crashkernel reserved region, diff --git a/security/security.c b/security/security.c index 287bfac6b471..b10230c51c0b 100644 --- a/security/security.c +++ b/security/security.c @@ -5675,3 +5675,13 @@ int security_uring_cmd(struct io_uring_cmd *ioucmd) return call_int_hook(uring_cmd, ioucmd); } #endif /* CONFIG_IO_URING */ + +/** + * security_initramfs_populated() - Notify LSMs that initramfs has been loaded + * + * Tells the LSMs the initramfs has been unpacked into the rootfs. + */ +void security_initramfs_populated(void) +{ + call_void_hook(initramfs_populated); +}
This patch introduces a new hook to notify security system that the content of initramfs has been unpacked into the rootfs. Upon receiving this notification, the security system can activate a policy to allow only files that originated from the initramfs to execute or load into kernel during the early stages of booting. This approach is crucial for minimizing the attack surface by ensuring that only trusted files from the initramfs are operational in the critical boot phase. Signed-off-by: Fan Wu <wufan@linux.microsoft.com> --- v1-v11: + Not present v12: + Introduced v13: + Rename the hook name to initramfs_populated() v14: + No changes v15: + No changes --- include/linux/lsm_hook_defs.h | 2 ++ include/linux/security.h | 8 ++++++++ init/initramfs.c | 3 +++ security/security.c | 10 ++++++++++ 4 files changed, 23 insertions(+)