From patchwork Wed Feb 7 15:45:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dongsu Park X-Patchwork-Id: 10205417 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 47A306020F for ; Wed, 7 Feb 2018 15:44:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 38C50283F9 for ; Wed, 7 Feb 2018 15:44:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2D4F428EEC; Wed, 7 Feb 2018 15:44:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9F9CE283F9 for ; Wed, 7 Feb 2018 15:44:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754521AbeBGPob (ORCPT ); Wed, 7 Feb 2018 10:44:31 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:35858 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754184AbeBGPny (ORCPT ); Wed, 7 Feb 2018 10:43:54 -0500 Received: by mail-wm0-f68.google.com with SMTP id f3so4186376wmc.1 for ; Wed, 07 Feb 2018 07:43:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=6/F1K00UM/B86PgweiSzWTUoGnJBHR2OdDWz6KAyTsY=; b=VLWJ86viLi8+/YPycA4gWoFvgImWkpigWONlOqGbIHVpsOrcI9r52JHD+yx4PKgRXE /EsiX8VzpUndz6cRHdzkJ7XoZ2kIunJYmiu9QBl5yAdjAHPC+5+K8mltzZgSIXaK0U74 3azJoS8Q/S8rQ8rFR2C8BWR2+uFZvwWKKZrC4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=6/F1K00UM/B86PgweiSzWTUoGnJBHR2OdDWz6KAyTsY=; b=t77kL5rixXRPXSG2LiOmSK0wL6knW3TX3wzF9TjOClFMQ2Idn8xNgfMfmbTIDTC1PB MisbvZs5VLHwd7NUSrlK2cSPDKWOEr5cyH6ohhNQJxqYzWaJxVYuzR7/MQvtoThwuuyG IR8Po6p+UNj4j8WK8bnOsVRLBVUdHhkTLl77nm6/9G6YMSO1TZu0zfKhJDh47qNzf6VJ lhD90tP/vY+WsZUsKgIhHOFkQSSwu04iemi6FPUaA5hJpJHjPcQDplcx9nstPJTZjOPk 6bmWg9ZoAmQ+unwLIYWnpvzVmKxnmF65iozYMZ5qVh6dHDv9JVeudCEl9UwLiohxAhl7 3+Mw== X-Gm-Message-State: APf1xPDQOPS+UuJ/AO41oCYKDkU2DtscION4b0XszdWO4SKP6wY7qarC o9iLaUZca/L82Ri4KomDipqq/Q== X-Google-Smtp-Source: AH8x224pw/Msq/5SQhHhIPzTvWysj9x6eVWN9RDD+eQvdCVY58OIIZCe74mLoR+DBV5SNu5mBnKpBA== X-Received: by 10.80.171.165 with SMTP id u34mr8710527edc.167.1518018233543; Wed, 07 Feb 2018 07:43:53 -0800 (PST) Received: from dberlin.localdomain ([178.19.216.175]) by smtp.gmail.com with ESMTPSA id 6sm1185594edl.87.2018.02.07.07.43.52 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 07 Feb 2018 07:43:53 -0800 (PST) From: Dongsu Park To: linux-kernel@vger.kernel.org Cc: linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Alexander Viro , Mimi Zohar , Dmitry Kasatkin , James Morris , Christoph Hellwig , Miklos Szeredi , "Serge E . Hallyn" , Seth Forshee , Alban Crequy , Dongsu Park Subject: [RFC PATCH v5 2/2] fuse: introduce new fs_type flag FS_IMA_NO_CACHE Date: Wed, 7 Feb 2018 16:45:13 +0100 Message-Id: <32720253472ebc444da9561834a5a5f2c7cbd7c1.1517999503.git.dongsu@kinvolk.io> X-Mailer: git-send-email 2.13.6 In-Reply-To: References: In-Reply-To: References: Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Alban Crequy This new fs_type flag FS_IMA_NO_CACHE means files should be re-measured, re-appraised and re-audited each time. Cached integrity results should not be used. It is useful in FUSE because the userspace FUSE process can change the underlying files at any time without notifying the kernel. FUSE can be mounted by unprivileged users either today with fusermount installed with setuid, or soon with the upcoming patches to allow FUSE mounts in a non-init user namespace. That makes the issue more visible than for network filesystems where unprivileged users cannot mount. How to test this: The test I did was using a patched version of the memfs FUSE driver [1][2] and two very simple "hello-world" programs [4] (prog1 prints "hello world: 1" and prog2 prints "hello world: 2"). I copy prog1 and prog2 in the fuse-memfs mount point, execute them and check the sha1 hash in "/sys/kernel/security/ima/ascii_runtime_measurements". My patch on the memfs FUSE driver added a backdoor command to serve prog1 when the kernel asks for prog2 or vice-versa. In this way, I can exec prog1 and get it to print "hello world: 2" without ever replacing the file via the VFS, so the kernel is not aware of the change. The test was done using the branch "dongsu/fuse-flag-ima-nocache-v5" [3]. Step by step test procedure: 1. Mount the memfs FUSE using [2]: rm -f /tmp/memfs-switch* ; memfs -L DEBUG /mnt/memfs 2. Copy prog1 and prog2 using [4] cp prog1 /mnt/memfs/prog1 cp prog2 /mnt/memfs/prog2 3. Lookup the files and let the FUSE driver to keep the handles open: dd if=/mnt/memfs/prog1 bs=1 | (read -n 1 x ; sleep 3600 ) & dd if=/mnt/memfs/prog2 bs=1 | (read -n 1 x ; sleep 3600 ) & 4. Check the 2 programs work correctly: $ /mnt/memfs/prog1 hello world: 1 $ /mnt/memfs/prog2 hello world: 2 5. Check the measurements for prog1 and prog2: $ sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog 10 [...] ima-ng sha1:ac14c9268cd2[...] /mnt/memfs/prog1 10 [...] ima-ng sha1:799cb5d1e06d[...] /mnt/memfs/prog2 6. Use the backdoor command in my patched memfs to redirect file operations on file handle 3 to file handle 2: rm -f /tmp/memfs-switch* ; touch /tmp/memfs-switch-3-2 7. Check how the FUSE driver serves different content for the files: $ /mnt/memfs/prog1 hello world: 2 $ /mnt/memfs/prog2 hello world: 2 8. Check the measurements: sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog Without the patch, there are no new measurements, despite the FUSE driver having served different executables. With the patch, I can see additional measurements for prog1 and prog2 with the hashes reversed when the FUSE driver served the alternative content. [1] https://github.com/bbengfort/memfs [2] https://github.com/kinvolk/memfs/commits/alban/switch-files [3] https://github.com/kinvolk/linux/commits/dongsu/fuse-flag-ima-nocache-v5 [4] https://github.com/kinvolk/fuse-userns-patches/commit/cf1f5750cab0 Cc: linux-kernel@vger.kernel.org Cc: linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: Alexander Viro Cc: Mimi Zohar Cc: Dmitry Kasatkin Cc: James Morris Cc: Christoph Hellwig Acked-by: Miklos Szeredi Acked-by: "Serge E. Hallyn" Acked-by: Seth Forshee Tested-by: Dongsu Park Signed-off-by: Alban Crequy --- fs/fuse/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index 624f18bb..0a9e5164 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -1205,7 +1205,7 @@ static void fuse_kill_sb_anon(struct super_block *sb) static struct file_system_type fuse_fs_type = { .owner = THIS_MODULE, .name = "fuse", - .fs_flags = FS_HAS_SUBTYPE, + .fs_flags = FS_HAS_SUBTYPE | FS_IMA_NO_CACHE, .mount = fuse_mount, .kill_sb = fuse_kill_sb_anon, };