From patchwork Thu Aug 10 23:41:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 9894747 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7739660384 for ; Thu, 10 Aug 2017 23:42:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 69D5D28BB8 for ; Thu, 10 Aug 2017 23:42:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5EBAE28BBA; Thu, 10 Aug 2017 23:42:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D073E28BB8 for ; Thu, 10 Aug 2017 23:42:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752176AbdHJXmV (ORCPT ); Thu, 10 Aug 2017 19:42:21 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:40727 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750868AbdHJXmR (ORCPT ); Thu, 10 Aug 2017 19:42:17 -0400 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v7ANdXts040452 for ; Thu, 10 Aug 2017 19:42:17 -0400 Received: from e23smtp02.au.ibm.com (e23smtp02.au.ibm.com [202.81.31.144]) by mx0a-001b2d01.pphosted.com with ESMTP id 2c8wrc11bv-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 10 Aug 2017 19:42:16 -0400 Received: from localhost by e23smtp02.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 11 Aug 2017 09:42:14 +1000 Received: from d23relay08.au.ibm.com (202.81.31.227) by e23smtp02.au.ibm.com (202.81.31.208) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Fri, 11 Aug 2017 09:42:12 +1000 Received: from d23av02.au.ibm.com (d23av02.au.ibm.com [9.190.235.138]) by d23relay08.au.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v7ANgCR828901522; Fri, 11 Aug 2017 09:42:12 +1000 Received: from d23av02.au.ibm.com (localhost [127.0.0.1]) by d23av02.au.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id v7ANg2NI020281; Fri, 11 Aug 2017 09:42:03 +1000 Received: from dhcp-9-2-55-123.watson.ibm.com (dhcp-9-2-55-123.watson.ibm.com [9.2.55.123]) by d23av02.au.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id v7ANfiIS019962; Fri, 11 Aug 2017 09:41:59 +1000 From: Mimi Zohar To: Christoph Hellwig , Al Viro Cc: Mimi Zohar , James Morris , linux-fsdevel@vger.kernel.org, linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org Subject: [PATCH v5 3/4] ima: define "dont_failsafe" policy action rule Date: Thu, 10 Aug 2017 19:41:46 -0400 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1502408507-4257-1-git-send-email-zohar@linux.vnet.ibm.com> References: <1502408507-4257-1-git-send-email-zohar@linux.vnet.ibm.com> X-TM-AS-MML: disable x-cbid: 17081023-0004-0000-0000-00000229E665 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17081023-0005-0000-0000-00005E1042EC Message-Id: <1502408507-4257-4-git-send-email-zohar@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-10_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=3 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1706020000 definitions=main-1708100370 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Permit normally denied access/execute permission for files in policy on IMA unsupported filesystems. This patch defines the "dont_failsafe" policy action rule. Signed-off-by: Mimi Zohar --- Changelog v3: - include dont_failsafe rule when displaying policy - fail attempt to add dont_failsafe rule when appending to the policy Documentation/ABI/testing/ima_policy | 3 ++- security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_main.c | 12 +++++++++++- security/integrity/ima/ima_policy.c | 29 ++++++++++++++++++++++++++++- 4 files changed, 42 insertions(+), 3 deletions(-) diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy index e76432b9954d..f271207743e5 100644 --- a/Documentation/ABI/testing/ima_policy +++ b/Documentation/ABI/testing/ima_policy @@ -17,7 +17,8 @@ Description: rule format: action [condition ...] - action: measure | dont_measure | appraise | dont_appraise | audit + action: measure | dont_meaure | appraise | dont_appraise | + audit | dont_failsafe condition:= base | lsm [option] base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=] [euid=] [fowner=]] diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index d52b487ad259..c5f34f7c5b0f 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -224,6 +224,7 @@ void *ima_policy_start(struct seq_file *m, loff_t *pos); void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos); void ima_policy_stop(struct seq_file *m, void *v); int ima_policy_show(struct seq_file *m, void *v); +void set_failsafe(bool flag); /* Appraise integrity measurements */ #define IMA_APPRAISE_ENFORCE 0x01 diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index eccac00c7e94..7d0e50f28c14 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -38,6 +38,12 @@ int ima_appraise; int ima_hash_algo = HASH_ALGO_SHA1; static int hash_setup_done; +static bool ima_failsafe = 1; +void set_failsafe(bool flag) +{ + ima_failsafe = flag; +} + static int __init hash_setup(char *str) { struct ima_template_desc *template_desc = ima_template_desc_current(); @@ -260,8 +266,12 @@ static int process_measurement(struct file *file, char *buf, loff_t size, __putname(pathbuf); out: inode_unlock(inode); - if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE)) + if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE)) { + if (!ima_failsafe && rc == -EBADF) + return 0; + return -EACCES; + } return 0; } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 95209a5f8595..43b85a4fb8e8 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -40,12 +40,14 @@ #define APPRAISE 0x0004 /* same as IMA_APPRAISE */ #define DONT_APPRAISE 0x0008 #define AUDIT 0x0040 +#define DONT_FAILSAFE 0x0400 #define INVALID_PCR(a) (((a) < 0) || \ (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8)) int ima_policy_flag; static int temp_ima_appraise; +static bool temp_failsafe = 1; #define MAX_LSM_RULES 6 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, @@ -513,6 +515,9 @@ void ima_update_policy(void) if (ima_rules != policy) { ima_policy_flag = 0; ima_rules = policy; + + /* Only update on initial policy replacement, not append */ + set_failsafe(temp_failsafe); } ima_update_policy_flag(); } @@ -529,7 +534,7 @@ enum { Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt, Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt, Opt_appraise_type, Opt_permit_directio, - Opt_pcr + Opt_pcr, Opt_dont_failsafe }; static match_table_t policy_tokens = { @@ -560,6 +565,7 @@ static match_table_t policy_tokens = { {Opt_appraise_type, "appraise_type=%s"}, {Opt_permit_directio, "permit_directio"}, {Opt_pcr, "pcr=%s"}, + {Opt_dont_failsafe, "dont_failsafe"}, {Opt_err, NULL} }; @@ -630,6 +636,11 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) if ((*p == '\0') || (*p == ' ') || (*p == '\t')) continue; token = match_token(p, policy_tokens, args); + if (entry->action == DONT_FAILSAFE) { + /* no args permitted, force invalid rule */ + token = Opt_dont_failsafe; + } + switch (token) { case Opt_measure: ima_log_string(ab, "action", "measure"); @@ -671,6 +682,19 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) entry->action = AUDIT; break; + case Opt_dont_failsafe: + ima_log_string(ab, "action", "dont_failsafe"); + + if (entry->action != UNKNOWN) + result = -EINVAL; + + /* Permit on initial policy replacement only */ + if (ima_rules != &ima_policy_rules) + temp_failsafe = 0; + else + result = -EINVAL; + entry->action = DONT_FAILSAFE; + break; case Opt_func: ima_log_string(ab, "func", args[0].from); @@ -949,6 +973,7 @@ void ima_delete_rules(void) int i; temp_ima_appraise = 0; + temp_failsafe = 1; list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) { for (i = 0; i < MAX_LSM_RULES; i++) kfree(entry->lsm[i].args_p); @@ -1040,6 +1065,8 @@ int ima_policy_show(struct seq_file *m, void *v) seq_puts(m, pt(Opt_dont_appraise)); if (entry->action & AUDIT) seq_puts(m, pt(Opt_audit)); + if (entry->action & DONT_FAILSAFE) + seq_puts(m, pt(Opt_dont_failsafe)); seq_puts(m, " ");