From patchwork Wed Feb 7 15:45:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dongsu Park X-Patchwork-Id: 10205419 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 95A506020F for ; Wed, 7 Feb 2018 15:44:34 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 86F9C283F9 for ; Wed, 7 Feb 2018 15:44:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7B5CE28EEC; Wed, 7 Feb 2018 15:44:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 11C64283F9 for ; Wed, 7 Feb 2018 15:44:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754657AbeBGPob (ORCPT ); Wed, 7 Feb 2018 10:44:31 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:37247 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754556AbeBGPny (ORCPT ); Wed, 7 Feb 2018 10:43:54 -0500 Received: by mail-wm0-f67.google.com with SMTP id v71so4181080wmv.2 for ; Wed, 07 Feb 2018 07:43:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=6/F1K00UM/B86PgweiSzWTUoGnJBHR2OdDWz6KAyTsY=; b=VLWJ86viLi8+/YPycA4gWoFvgImWkpigWONlOqGbIHVpsOrcI9r52JHD+yx4PKgRXE /EsiX8VzpUndz6cRHdzkJ7XoZ2kIunJYmiu9QBl5yAdjAHPC+5+K8mltzZgSIXaK0U74 3azJoS8Q/S8rQ8rFR2C8BWR2+uFZvwWKKZrC4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=6/F1K00UM/B86PgweiSzWTUoGnJBHR2OdDWz6KAyTsY=; b=gW6e6lYsL1aUJz+41VMo9BvEUiGLyZst0p2EyXBhC4tAbCrmGdf2EoKGeqH9yqMni3 hV4mbJaminMQB7Su0hnwRrVuVewzr8vIiYJ/g8409ZCpbsrrJp+luDPlXIeT4s3Uh69R /AWTNUgNhUngNsRPDm8DqYQE+NSmKb9eOmmz5il43nS3BqlOsr4dlXyQ+741Zb+IsTpC vKM2PTnskbY+EbFZeU6XrAF7r1DquJKeZK0Q6jhFrmyHS1yXlqm0MBWkmYbmhhpbefuv BBJ9wlD7XNnMYvmVliDQTeo+Z4QTcom+LyKJkC+kJYjD52s69zTMUaBXAzp+/OuVVI7N LVcQ== X-Gm-Message-State: APf1xPBoGBbCEWv9srE/ZLa5ecX89WZb1CtuMvtLqKoaRdoLAHFNZzKl hAuYGogqudv3Eqw6/Tx7mO5Oyw== X-Google-Smtp-Source: AH8x224pw/Msq/5SQhHhIPzTvWysj9x6eVWN9RDD+eQvdCVY58OIIZCe74mLoR+DBV5SNu5mBnKpBA== X-Received: by 10.80.171.165 with SMTP id u34mr8710527edc.167.1518018233543; Wed, 07 Feb 2018 07:43:53 -0800 (PST) Received: from dberlin.localdomain ([178.19.216.175]) by smtp.gmail.com with ESMTPSA id 6sm1185594edl.87.2018.02.07.07.43.52 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 07 Feb 2018 07:43:53 -0800 (PST) From: Dongsu Park To: linux-kernel@vger.kernel.org Cc: linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Alexander Viro , Mimi Zohar , Dmitry Kasatkin , James Morris , Christoph Hellwig , Miklos Szeredi , "Serge E . Hallyn" , Seth Forshee , Alban Crequy , Dongsu Park Subject: [RFC PATCH v5 2/2] fuse: introduce new fs_type flag FS_IMA_NO_CACHE Date: Wed, 7 Feb 2018 16:45:13 +0100 Message-Id: <32720253472ebc444da9561834a5a5f2c7cbd7c1.1517999503.git.dongsu@kinvolk.io> X-Mailer: git-send-email 2.13.6 In-Reply-To: References: In-Reply-To: References: Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Alban Crequy This new fs_type flag FS_IMA_NO_CACHE means files should be re-measured, re-appraised and re-audited each time. Cached integrity results should not be used. It is useful in FUSE because the userspace FUSE process can change the underlying files at any time without notifying the kernel. FUSE can be mounted by unprivileged users either today with fusermount installed with setuid, or soon with the upcoming patches to allow FUSE mounts in a non-init user namespace. That makes the issue more visible than for network filesystems where unprivileged users cannot mount. How to test this: The test I did was using a patched version of the memfs FUSE driver [1][2] and two very simple "hello-world" programs [4] (prog1 prints "hello world: 1" and prog2 prints "hello world: 2"). I copy prog1 and prog2 in the fuse-memfs mount point, execute them and check the sha1 hash in "/sys/kernel/security/ima/ascii_runtime_measurements". My patch on the memfs FUSE driver added a backdoor command to serve prog1 when the kernel asks for prog2 or vice-versa. In this way, I can exec prog1 and get it to print "hello world: 2" without ever replacing the file via the VFS, so the kernel is not aware of the change. The test was done using the branch "dongsu/fuse-flag-ima-nocache-v5" [3]. Step by step test procedure: 1. Mount the memfs FUSE using [2]: rm -f /tmp/memfs-switch* ; memfs -L DEBUG /mnt/memfs 2. Copy prog1 and prog2 using [4] cp prog1 /mnt/memfs/prog1 cp prog2 /mnt/memfs/prog2 3. Lookup the files and let the FUSE driver to keep the handles open: dd if=/mnt/memfs/prog1 bs=1 | (read -n 1 x ; sleep 3600 ) & dd if=/mnt/memfs/prog2 bs=1 | (read -n 1 x ; sleep 3600 ) & 4. Check the 2 programs work correctly: $ /mnt/memfs/prog1 hello world: 1 $ /mnt/memfs/prog2 hello world: 2 5. Check the measurements for prog1 and prog2: $ sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog 10 [...] ima-ng sha1:ac14c9268cd2[...] /mnt/memfs/prog1 10 [...] ima-ng sha1:799cb5d1e06d[...] /mnt/memfs/prog2 6. Use the backdoor command in my patched memfs to redirect file operations on file handle 3 to file handle 2: rm -f /tmp/memfs-switch* ; touch /tmp/memfs-switch-3-2 7. Check how the FUSE driver serves different content for the files: $ /mnt/memfs/prog1 hello world: 2 $ /mnt/memfs/prog2 hello world: 2 8. Check the measurements: sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog Without the patch, there are no new measurements, despite the FUSE driver having served different executables. With the patch, I can see additional measurements for prog1 and prog2 with the hashes reversed when the FUSE driver served the alternative content. [1] https://github.com/bbengfort/memfs [2] https://github.com/kinvolk/memfs/commits/alban/switch-files [3] https://github.com/kinvolk/linux/commits/dongsu/fuse-flag-ima-nocache-v5 [4] https://github.com/kinvolk/fuse-userns-patches/commit/cf1f5750cab0 Cc: linux-kernel@vger.kernel.org Cc: linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: Alexander Viro Cc: Mimi Zohar Cc: Dmitry Kasatkin Cc: James Morris Cc: Christoph Hellwig Acked-by: Miklos Szeredi Acked-by: "Serge E. Hallyn" Acked-by: Seth Forshee Tested-by: Dongsu Park Signed-off-by: Alban Crequy --- fs/fuse/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index 624f18bb..0a9e5164 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -1205,7 +1205,7 @@ static void fuse_kill_sb_anon(struct super_block *sb) static struct file_system_type fuse_fs_type = { .owner = THIS_MODULE, .name = "fuse", - .fs_flags = FS_HAS_SUBTYPE, + .fs_flags = FS_HAS_SUBTYPE | FS_IMA_NO_CACHE, .mount = fuse_mount, .kill_sb = fuse_kill_sb_anon, };