From patchwork Wed Sep 7 20:49:42 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 9319893 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CF506607D3 for ; Wed, 7 Sep 2016 20:49:48 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BB01129421 for ; Wed, 7 Sep 2016 20:49:48 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AFC0F29423; Wed, 7 Sep 2016 20:49:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 30D0629425 for ; Wed, 7 Sep 2016 20:49:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754598AbcIGUtr (ORCPT ); Wed, 7 Sep 2016 16:49:47 -0400 Received: from mail-oi0-f53.google.com ([209.85.218.53]:33216 "EHLO mail-oi0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750772AbcIGUtq (ORCPT ); Wed, 7 Sep 2016 16:49:46 -0400 Received: by mail-oi0-f53.google.com with SMTP id y2so43697685oie.0 for ; Wed, 07 Sep 2016 13:49:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=4wlfJFCcgXk08msWo3d0bJKw9HHQKtg7I7hC7vQHyV4=; b=kTdUStzUaUZzs5gy/cJ7QpBPBNrYKpKK2FxZdqLBuB7Y9qaAdZhsbLxpyNuOxJNcHS Mlb7e5dclVBkdOvyw0nxXRZ8H8pZSBy4IwJ5Zl6Db0JwrAqKIFq5n5NUQjCUtjvwyT8k vz6m46Gt6QL8ViyGuMbO8Wz6HkYyxjPBfEYCniGnOqvvkbeqkRyXbbe8oxLsliaM+8Ca 61+lDpx3/FSpHGVZDfdVaqHWtx5U5+KHD3iiyHyENWkyBjGh9byB3FOAWX6PTpXchVG/ MMgSWh5dQuTYuFEIhvESUH1cSM9Z0nWcN/gbASAe12zGfWQpH3ocFg6IbQHdb5OEZiXk HYRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=4wlfJFCcgXk08msWo3d0bJKw9HHQKtg7I7hC7vQHyV4=; b=WL065Shy6zGuMBQ5q86zYgG4qnBQSP9PxGP4WjI4BGooDxdHO6A/h2rJOzRUQSWzdz z4DXJ4bw49r1sZQrZgyMmE+B9gsrbHd+IecUpS5E/NlSqN+wG1iIBLNvRU10+J0GVLsW 99NQXxwMw3LOkWmXe6/78JH8n2gYmprQk1m6FSnXFaQ6iGeYFGbcJQ/1TfkdVMsZoPmI 5/2UgYmR4z4iW8Xc63TmRfPbafqJuhrBFgvay7CRxPd77nKggnK/a45rUxwomP1lvJA6 VBZiHKNfVu4Zt8Z3Rp8VkMaQ+FfC/wPJHNx+nDn66Mv5lUdRHyMLnXbaB50DnuPUocxV AuoQ== X-Gm-Message-State: AE9vXwNZyZ9bCORE4/kP6YwJkDg1J6uDs2gDKcRConqmboKLqbvwPISBRLX96psYggS6Z0UB X-Received: by 10.157.43.174 with SMTP id u43mr13968017ota.76.1473281385981; Wed, 07 Sep 2016 13:49:45 -0700 (PDT) Received: from localhost ([2605:a601:aa9:6620:d4eb:affd:1959:c40a]) by smtp.gmail.com with ESMTPSA id f11sm3007873oig.23.2016.09.07.13.49.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Sep 2016 13:49:45 -0700 (PDT) From: Seth Forshee To: Mimi Zohar Cc: "Eric W. Biederman" , Dmitry Kasatkin , linux-ima-devel@lists.sourceforge.net, linux-ima-user@lists.sourceforge.net, linux-security-module@vger.kernel.org Subject: [RFC 1/2] evm: Ignore EVM xattrs from user namespace mounts Date: Wed, 7 Sep 2016 15:49:42 -0500 Message-Id: <1473281383-144843-2-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1473281383-144843-1-git-send-email-seth.forshee@canonical.com> References: <1473281383-144843-1-git-send-email-seth.forshee@canonical.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Ignore these xattrs in filesystems mounted in non-init user namespaces to avoid preventing access to files, and refuse to calculate new hmacs for files in these mounts. Writing EVM xattrs from userspace already requires global CAP_SYS_ADMIN, so no changes are required to prevent this. Signed-off-by: Seth Forshee --- security/integrity/evm/evm_crypto.c | 2 +- security/integrity/evm/evm_main.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c index 11c1d30bd705..5a1738524fbb 100644 --- a/security/integrity/evm/evm_crypto.c +++ b/security/integrity/evm/evm_crypto.c @@ -182,7 +182,7 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, int error; int size; - if (!inode->i_op->getxattr) + if (inode->i_sb->s_user_ns != &init_user_ns || !inode->i_op->getxattr) return -EOPNOTSUPP; desc = init_desc(type); if (IS_ERR(desc)) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 35ab453ce861..7590f010d639 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -118,6 +118,9 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, enum integrity_status evm_status = INTEGRITY_PASS; int rc, xattr_len; + if (d_backing_inode(dentry)->i_sb->s_user_ns != &init_user_ns) + return INTEGRITY_UNKNOWN; + if (iint && iint->evm_status == INTEGRITY_PASS) return iint->evm_status;