From patchwork Tue Jan 30 18:06:32 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dongsu Park X-Patchwork-Id: 10192171 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C890060383 for ; Tue, 30 Jan 2018 18:06:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BA68922376 for ; Tue, 30 Jan 2018 18:06:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AF5CF2465D; Tue, 30 Jan 2018 18:06:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8E1A722376 for ; Tue, 30 Jan 2018 18:06:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753046AbeA3SGf (ORCPT ); Tue, 30 Jan 2018 13:06:35 -0500 Received: from mail-wm0-f65.google.com ([74.125.82.65]:56136 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753101AbeA3SFb (ORCPT ); Tue, 30 Jan 2018 13:05:31 -0500 Received: by mail-wm0-f65.google.com with SMTP id 143so2948198wma.5 for ; Tue, 30 Jan 2018 10:05:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=5LLYDrK5Nlsjv/ZLl79kR8DsbZ0gvfEVeO64d08bB7Y=; b=DuY/zinrP18gFPq53JpIjIz1vsTxTxlI6D23JzSro/qlW0WMSx9A5v7sBbS2DKzwIe nLKQC2S8TMXj9Ag30cX9s6MPp1XabyO9AjNI+053Hn8x8Z1DjlbciLC74Y1TTp3BxkQi 1dx2g/SyTeWIpOgC4yOX9v8Yz0TvDB0azIp3Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=5LLYDrK5Nlsjv/ZLl79kR8DsbZ0gvfEVeO64d08bB7Y=; b=jyBuSSU55AsAZNd49dYMPhfeLIdRnLo82lqFG/rXMhA73CgwUvch9idvNeqlYb83Tn LQoZVGrrLJtUvISXkLvw0K7CHTSzF9A4ZY8taFG+5ca1FuacWE7fdKT97KyFzZMvNY+K wmQ61Jt/A4jEL/RUKJ2WsKmh5JdLab0L4jiHN6YpBqWoWewFWARyFl9CnGbxfRXaPSXt Jsu68/B4rxOF4vwgevWHbOIh9RxyE21lC5um1X58f+JCZAs01f+0UwIl62STBc1tiywz dHhw0/1tOhRn92xI3etwxPSOP99zM8qoh2QxrcC2KEa4rZ2M14IClKtSJ9wlRtve/r4U Vsxw== X-Gm-Message-State: AKwxytdRaStYJCPOmggENO36qsPLdI1LRpKM9wdTjRZ3vWjYwnjtfKIL L0NX9wo3qUQVDYVFKrJZWRnsJA== X-Google-Smtp-Source: AH8x2262LXshfUAnWP+umbDX1q22Z87xJJhAV7aoB8EKG6ChVptTPHw5Vf/ccQepl6Pw7CQvly20qw== X-Received: by 10.80.131.67 with SMTP id 61mr53131651edh.16.1517335530276; Tue, 30 Jan 2018 10:05:30 -0800 (PST) Received: from dberlin.localdomain (cable-86-56-52-218.cust.telecolumbus.net. [86.56.52.218]) by smtp.gmail.com with ESMTPSA id z49sm7692787edd.93.2018.01.30.10.05.29 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 30 Jan 2018 10:05:29 -0800 (PST) From: Dongsu Park To: linux-kernel@vger.kernel.org Cc: linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Alban Crequy , Dongsu Park , Miklos Szeredi , Alexander Viro , Mimi Zohar , Dmitry Kasatkin , James Morris , Christoph Hellwig , "Serge E . Hallyn" , Seth Forshee , Miklos Szeredi Subject: [RFC PATCH v4 2/2] ima: force re-appraisal on filesystems with FS_IMA_NO_CACHE Date: Tue, 30 Jan 2018 19:06:32 +0100 Message-Id: <10ef27e369ce46652ee7b2b6238aa4551de2be8b.1517314847.git.dongsu@kinvolk.io> X-Mailer: git-send-email 2.13.6 In-Reply-To: References: In-Reply-To: References: Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Alban Crequy This patch forces files to be re-measured, re-appraised and re-audited on file systems with the feature flag FS_IMA_NO_CACHE. In that way, cached integrity results won't be used. How to test this: The test I did was using a patched version of the memfs FUSE driver [1][2] and two very simple "hello-world" programs [4] (prog1 prints "hello world: 1" and prog2 prints "hello world: 2"). I copy prog1 and prog2 in the fuse-memfs mount point, execute them and check the sha1 hash in "/sys/kernel/security/ima/ascii_runtime_measurements". My patch on the memfs FUSE driver added a backdoor command to serve prog1 when the kernel asks for prog2 or vice-versa. In this way, I can exec prog1 and get it to print "hello world: 2" without ever replacing the file via the VFS, so the kernel is not aware of the change. The test was done using the branch "dongsu/fuse-flag-ima-nocache-v4" [3]. Step by step test procedure: 1. Mount the memfs FUSE using [2]: rm -f /tmp/memfs-switch* ; memfs -L DEBUG /mnt/memfs 2. Copy prog1 and prog2 using [4] cp prog1 /mnt/memfs/prog1 cp prog2 /mnt/memfs/prog2 3. Lookup the files and let the FUSE driver to keep the handles open: dd if=/mnt/memfs/prog1 bs=1 | (read -n 1 x ; sleep 3600 ) & dd if=/mnt/memfs/prog2 bs=1 | (read -n 1 x ; sleep 3600 ) & 4. Check the 2 programs work correctly: $ /mnt/memfs/prog1 hello world: 1 $ /mnt/memfs/prog2 hello world: 2 5. Check the measurements for prog1 and prog2: $ sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog 10 [...] ima-ng sha1:ac14c9268cd2[...] /mnt/memfs/prog1 10 [...] ima-ng sha1:799cb5d1e06d[...] /mnt/memfs/prog2 6. Use the backdoor command in my patched memfs to redirect file operations on file handle 3 to file handle 2: rm -f /tmp/memfs-switch* ; touch /tmp/memfs-switch-3-2 7. Check how the FUSE driver serves different content for the files: $ /mnt/memfs/prog1 hello world: 2 $ /mnt/memfs/prog2 hello world: 2 8. Check the measurements: sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog Without the patch, there are no new measurements, despite the FUSE driver having served different executables. With the patch, I can see additional measurements for prog1 and prog2 with the hashes reversed when the FUSE driver served the alternative content. [1] https://github.com/bbengfort/memfs [2] https://github.com/kinvolk/memfs/commits/alban/switch-files [3] https://github.com/kinvolk/linux/commits/dongsu/fuse-flag-ima-nocache-v4 [4] https://github.com/kinvolk/fuse-userns-patches/commit/cf1f5750cab0 Cc: linux-kernel@vger.kernel.org Cc: linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: Miklos Szeredi Cc: Alexander Viro Cc: Mimi Zohar Cc: Dmitry Kasatkin Cc: James Morris Cc: Christoph Hellwig Acked-by: "Serge E. Hallyn" Acked-by: Seth Forshee Tested-by: Dongsu Park Signed-off-by: Alban Crequy [dongsu: optimized code to address review comments by Mimi] Signed-off-by: Dongsu Park --- security/integrity/ima/ima_main.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 6d78cb26..83edbad8 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -24,6 +24,7 @@ #include #include #include +#include #include "ima.h" @@ -228,9 +229,19 @@ static int process_measurement(struct file *file, char *buf, loff_t size, IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK | IMA_ACTION_FLAGS); - if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) - /* reset all flags if ima_inode_setxattr was called */ + /* + * Reset the measure, appraise and audit cached flags either if: + * - ima_inode_setxattr was called, or + * - based on filesystem feature flag + * forcing the file to be re-evaluated. + */ + if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) { iint->flags &= ~IMA_DONE_MASK; + } else if (inode->i_sb->s_type->fs_flags & FS_IMA_NO_CACHE) { + iint->flags &= ~IMA_DONE_MASK; + if (action & IMA_MEASURE) + iint->measured_pcrs = 0; + } /* Determine if already appraised/measured based on bitmask * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,