From patchwork Tue Jan 16 15:10:00 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alban Crequy X-Patchwork-Id: 10167415 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 66F01601E7 for ; Tue, 16 Jan 2018 15:11:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 15781285EA for ; Tue, 16 Jan 2018 15:11:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0A05F28647; Tue, 16 Jan 2018 15:11:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,FREEMAIL_FROM,RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B11CA28691 for ; Tue, 16 Jan 2018 15:11:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750868AbeAPPLO (ORCPT ); Tue, 16 Jan 2018 10:11:14 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:42683 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750825AbeAPPLM (ORCPT ); Tue, 16 Jan 2018 10:11:12 -0500 Received: by mail-wm0-f67.google.com with SMTP id b141so9120636wme.1; Tue, 16 Jan 2018 07:11:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=F1X51wNDkt2y+3ht3MzUtOecjyrt4ztJgiwDZupC92M=; b=adoafZri/n6OjUEOu+fcymbYs7hag66dH59doKi81GM0r7d0MnPuGy4brAuiRyYMLq Tta9sZLAJLP/rHpEPvOG61gfq6DTlKDAX+aWYZMmkob467bXB519cBZs7LDPFsvLCvN9 cs2mg8TlhIDo7udMBNpK3RT91MKT0XhvYfjXvkZCjK/uHXlPHsSYUh8CurQmPo3A6Znh BUKljYzqRkBFzetdyTLUgx0e1H8dY7tLGkITTFUv4cYBQ8Qza/cTsRs9VPfFlH9HIwbz drbKLkazoedPpzKtNQLyF56856/y1dBOlo9gS6j9tQX1TdzXjUnFVzfcdgVGNnDIi9CQ +yrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=F1X51wNDkt2y+3ht3MzUtOecjyrt4ztJgiwDZupC92M=; b=DXrxTpJs/6kA0wOgxpbGuOOK5iGeEK8Xvvu9/+BUd8Yi616C/VmXu61ZW0Gp1233eT 11uGqJzOANIuyOCoyN+9NuLSu0rL54qFWIRG8XNIPCM/qU+aAmUIFcXNY8VPpGMYwT0G M7zGenZlyNWI7TRqroaWW1wJm0l0+aEhwLGxmEeFMhEtGg9X05NwydnzXR3IekB9Uz6s yyz1cZXAU66xZPB8ejn11FefHsbvRH4E6QNm8Jt9SASNvEaCWuWXe18SWoWcqtgDQ4ad +r+5jYUDH6GiCSwDzeHtmGf0+EiI3PupPNZWvo7Tm159fynCly6V23KZOqutnYZU4MSW 7/zg== X-Gm-Message-State: AKwxytcB2v3b5IhNMhw4+Vq42+OMmrIcqcWagf8x+MKQJIPsgb7FzV02 ukj2Jgz82ELoSh+TpzVwc4M= X-Google-Smtp-Source: ACJfBosMbQ2HvzGNC7pEsD1+li1NykcS4vNJ4uK7SA//HxJctcWD2vyUl7+dkkverjFId9csUxbWvQ== X-Received: by 10.80.151.213 with SMTP id f21mr11717322edb.163.1516115470551; Tue, 16 Jan 2018 07:11:10 -0800 (PST) Received: from localhost.localdomain ([178.19.216.175]) by smtp.gmail.com with ESMTPSA id q10sm1631311edc.32.2018.01.16.07.11.09 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 16 Jan 2018 07:11:09 -0800 (PST) From: Alban Crequy X-Google-Original-From: Alban Crequy To: Alban Crequy Cc: iago@kinvolk.io, dongsu@kinvolk.io, linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Miklos Szeredi , Alexander Viro , Mimi Zohar , Dmitry Kasatkin , James Morris , "Serge E. Hallyn" , Seth Forshee , Christoph Hellwig Subject: [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE Date: Tue, 16 Jan 2018 16:10:00 +0100 Message-Id: <20180116151000.443-1-alban@kinvolk.io> X-Mailer: git-send-email 2.13.6 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Alban Crequy This patch forces files to be re-measured, re-appraised and re-audited on file systems with the feature flag FS_NO_IMA_CACHE. In that way, cached integrity results won't be used. For now, this patch adds the new flag only FUSE filesystems. This is needed because the userspace FUSE process can change the underlying files at any time. How to test this: ==== The test I did was using a patched version of the memfs FUSE driver [2][3] and two very simple "hello-world" programs [5] (prog1 prints "hello world: 1" and prog2 prints "hello world: 2"). I copy prog1 and prog2 in the fuse-memfs mount point, execute them and check the sha1 hash in "/sys/kernel/security/ima/ascii_runtime_measurements". My patch on the memfs FUSE driver added a backdoor command to serve prog1 when the kernel asks for prog2 or vice-versa. In this way, I can exec prog1 and get it to print "hello world: 2" without ever replacing the file via the VFS, so the kernel is not aware of the change. The test was done using the branch "alban/fuse-flag-ima-nocache-v2" [4]. Step by step test procedure: 1. Mount the memfs FUSE using [3]: rm -f /tmp/memfs-switch* ; memfs -L DEBUG /mnt/memfs 2. Copy prog1 and prog2 using [5] cp prog1 /mnt/memfs/prog1 cp prog2 /mnt/memfs/prog2 3. Lookup the files and let the FUSE driver to keep the handles open: dd if=/mnt/memfs/prog1 bs=1 | (read -n 1 x ; sleep 3600 ) & dd if=/mnt/memfs/prog2 bs=1 | (read -n 1 x ; sleep 3600 ) & 4. Check the 2 programs work correctly: $ /mnt/memfs/prog1 hello world: 1 $ /mnt/memfs/prog2 hello world: 2 5. Check the measurements for prog1 and prog2: $ sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog 10 [...] ima-ng sha1:ac14c9268cd2[...] /mnt/memfs/prog1 10 [...] ima-ng sha1:799cb5d1e06d[...] /mnt/memfs/prog2 6. Use the backdoor command in my patched memfs to redirect file operations on file handle 3 to file handle 2: rm -f /tmp/memfs-switch* ; touch /tmp/memfs-switch-3-2 7. Check how the FUSE driver serves different content for the files: $ /mnt/memfs/prog1 hello world: 2 $ /mnt/memfs/prog2 hello world: 2 8. Check the measurements: sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ | grep /mnt/memfs/prog Without the patch, there are no new measurements, despite the FUSE driver having served different executables. With the patch, I can see additional measurements for prog1 and prog2 with the hashes reversed when the FUSE driver served the alternative content. ==== [1] https://www.spinics.net/lists/linux-integrity/msg00948.html [2] https://github.com/bbengfort/memfs [3] https://github.com/kinvolk/memfs/commits/alban/switch-files [4] https://github.com/kinvolk/linux/commits/alban/fuse-flag-ima-nocache-v2 [5] https://github.com/kinvolk/fuse-userns-patches/commit/cf1f5750cab0 Cc: linux-kernel@vger.kernel.org Cc: linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: Miklos Szeredi Cc: Alexander Viro Cc: Mimi Zohar Cc: Dmitry Kasatkin Cc: James Morris Cc: "Serge E. Hallyn" Cc: Seth Forshee Cc: Christoph Hellwig Tested-by: Dongsu Park Signed-off-by: Alban Crequy --- There was a previous attempt (unmerged) with a IMA option named "force" and using that option for FUSE filesystems. This patch uses a different approach so that the IMA subsystem does not need to know about FUSE. - https://www.spinics.net/lists/linux-integrity/msg00948.html - https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1584131.html Changes since v1: https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1587390.html - include linux-fsdevel mailing list in cc - mark patch as RFC - based on next-integrity, without other unmerged FUSE / IMA patches --- fs/fuse/inode.c | 2 +- include/linux/fs.h | 1 + security/integrity/ima/ima_main.c | 24 ++++++++++++++++++++++-- 3 files changed, 24 insertions(+), 3 deletions(-) diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index 624f18bbfd2b..5bf14289afba 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -1205,7 +1205,7 @@ static void fuse_kill_sb_anon(struct super_block *sb) static struct file_system_type fuse_fs_type = { .owner = THIS_MODULE, .name = "fuse", - .fs_flags = FS_HAS_SUBTYPE, + .fs_flags = FS_HAS_SUBTYPE | FS_NO_IMA_CACHE, .mount = fuse_mount, .kill_sb = fuse_kill_sb_anon, }; diff --git a/include/linux/fs.h b/include/linux/fs.h index 511fbaabf624..2bd7e73ebc2a 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2075,6 +2075,7 @@ struct file_system_type { #define FS_BINARY_MOUNTDATA 2 #define FS_HAS_SUBTYPE 4 #define FS_USERNS_MOUNT 8 /* Can be mounted by userns root */ +#define FS_NO_IMA_CACHE 16 /* Force IMA to re-measure, re-appraise, re-audit files */ #define FS_RENAME_DOES_D_MOVE 32768 /* FS will handle d_move() during rename() internally. */ struct dentry *(*mount) (struct file_system_type *, int, const char *, void *); diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 6d78cb26784d..2ce4d69068a8 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -24,6 +24,7 @@ #include #include #include +#include #include "ima.h" @@ -228,9 +229,28 @@ static int process_measurement(struct file *file, char *buf, loff_t size, IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK | IMA_ACTION_FLAGS); - if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) - /* reset all flags if ima_inode_setxattr was called */ + /* + * Reset the measure, appraise and audit cached flags either if: + * - ima_inode_setxattr was called, or + * - based on filesystem feature flag + * forcing the file to be re-evaluated. + */ + if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) { iint->flags &= ~IMA_DONE_MASK; + } else if (inode->i_sb->s_type->fs_flags & FS_NO_IMA_CACHE) { + if (action & IMA_MEASURE) { + iint->measured_pcrs = 0; + iint->flags &= + ~(IMA_COLLECTED | IMA_MEASURE | IMA_MEASURED); + } + if (action & IMA_APPRAISE) + iint->flags &= + ~(IMA_COLLECTED | IMA_APPRAISE | IMA_APPRAISED | + IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK); + if (action & IMA_AUDIT) + iint->flags &= + ~(IMA_COLLECTED | IMA_AUDIT | IMA_AUDITED); + } /* Determine if already appraised/measured based on bitmask * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,