From patchwork Fri Apr 13 15:27:52 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 10340275 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 47A1960329 for ; Fri, 13 Apr 2018 15:28:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2B6112842A for ; Fri, 13 Apr 2018 15:28:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 202F228585; Fri, 13 Apr 2018 15:28:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A61DE2842A for ; Fri, 13 Apr 2018 15:28:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750864AbeDMP2C (ORCPT ); Fri, 13 Apr 2018 11:28:02 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:48264 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750761AbeDMP2B (ORCPT ); Fri, 13 Apr 2018 11:28:01 -0400 Received: from pps.filterd (m0098413.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w3DFQtlH033164 for ; Fri, 13 Apr 2018 11:28:00 -0400 Received: from e06smtp15.uk.ibm.com (e06smtp15.uk.ibm.com [195.75.94.111]) by mx0b-001b2d01.pphosted.com with ESMTP id 2haw9qxa50-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Fri, 13 Apr 2018 11:28:00 -0400 Received: from localhost by e06smtp15.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 13 Apr 2018 16:27:57 +0100 Received: from b06cxnps4076.portsmouth.uk.ibm.com (9.149.109.198) by e06smtp15.uk.ibm.com (192.168.101.145) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Fri, 13 Apr 2018 16:27:55 +0100 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id w3DFRs3Y56033344; Fri, 13 Apr 2018 15:27:54 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 151AE4C046; Fri, 13 Apr 2018 16:20:31 +0100 (BST) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3C33B4C040; Fri, 13 Apr 2018 16:20:30 +0100 (BST) Received: from localhost.localdomain (unknown [9.80.105.39]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 13 Apr 2018 16:20:30 +0100 (BST) Subject: [PATCH] lockdown: fix coordination of kernel module signature verification From: Mimi Zohar To: David Howells Cc: Luca Boccassi , "Bruno E. O. Meneguele" , linux-integrity , linux-security-module , linux-kernel Date: Fri, 13 Apr 2018 11:27:52 -0400 X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 X-TM-AS-GCONF: 00 x-cbid: 18041315-0020-0000-0000-000004119D54 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18041315-0021-0000-0000-000042A5D0B4 Message-Id: <1523633272.3272.30.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-04-13_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1804130142 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If both IMA-appraisal and sig_enforce are enabled, then both signatures are currently required. If the IMA-appraisal signature verification fails, it could rely on the appended signature verification; but with the lockdown patch set, the appended signature verification assumes that if IMA-appraisal is enabled, it has verified the signature. Basically each signature verification method would be relying on the other to verify the kernel module signature. This patch addresses the problem of requiring both kernel module signature verification methods, when both are enabled, by verifying just the appended signature. Signed-off-by: Mimi Zohar Acked-by: Bruno E. O. Meneguele --- kernel/module.c | 4 +--- security/integrity/ima/ima_main.c | 7 ++++++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/module.c b/kernel/module.c index 9c1709a05037..60861eb7bc4d 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2803,9 +2803,7 @@ static int module_sig_check(struct load_info *info, int flags, if (sig_enforce) { pr_notice("%s is rejected\n", reason); return -EKEYREJECTED; - } - - if (can_do_ima_check && is_ima_appraise_enabled()) + } else if (can_do_ima_check && is_ima_appraise_enabled()) return 0; if (kernel_is_locked_down(reason)) return -EPERM; diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 754ece08e1c6..2155b1f316a4 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -480,6 +480,7 @@ static int read_idmap[READING_MAX_ID] = { int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id read_id) { + bool sig_enforce = is_module_sig_enforced(); enum ima_hooks func; u32 secid; @@ -490,7 +491,11 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, return 0; } - if (!file && read_id == READING_MODULE) /* MODULE_SIG_FORCE enabled */ + /* + * If both IMA-appraisal and appended signature verification are + * enabled, rely on the appended signature verification. + */ + if (sig_enforce && read_id == READING_MODULE) return 0; /* permit signed certs */