Received: by 10.223.176.46 with SMTP id f43csp3439889wra; Mon, 22 Jan 2018 14:25:07 -0800 (PST) X-Google-Smtp-Source: AH8x227cLG1XqbwtZo2gRvF0UoNaP06gVHFPGeHqAZHvTenH/CMvvPm53LKuZdmIk0xaDllmcddN X-Received: by 10.36.198.197 with SMTP id j188mr627202itg.76.1516659906915; Mon, 22 Jan 2018 14:25:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1516659906; cv=none; d=google.com; s=arc-20160816; b=gKP6ZYLcOpSmm6WD14Me9+C/fhJVAU+PeuaAOKLEGG2F8+A4av/jIkacJWXHHU3emn 4axjBfq3d1MuXXk71ESI/44Y9xLypPZGc7GDvNSYvOdT1vhA71nKtfmsyK/Ce8aE/rxQ BR946n1bXVYPRSD/boqr55wVUt/KA/+d/btljS/LGSSyDOVdBGAj6CyDTo6glmydv4h/ i4OIzdIif6MIb9mBrPoJ7R3bhRzis9p9fBfoouzn4+HXJahgV2bXBEp+0zC3BVEFhBrw 3oMslpw2tjMeKEqk2nsF/OTMpbs6OEbKFhxHMKwBAPwpbEf+AnPTAKUAzyrpv/yFuLsQ dSkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:arc-authentication-results; bh=W46TmR34o9Vbg9lMyC8Ywqcs1ZwOC2kLOdUppF0Ndhg=; b=hBE4af9hL3CK5xQaMxhvFAHS/2GHSnrUQBmPaSPQtxKQ7t6M7+cuJ01mBjw5TlGrmJ mkWF/U/4iO2AyfDC8g6fTzFpn1hncknCEqD1SDhnNMrrskOBGyDiYGK6ic5xCZg0tnbF 7Schpohwd5FxxqUbLFl7LAcgB3v0jkLs+yQ1L2Zw7N6d8giJraj/OZH9iSn3rI07Yccu GG+b+7PcHz5awaNp4StV9ZMjFHYW+zlVuta5gX4nqCtAQ3fX5c+Q1qMGHlyPA6lVA5wH owRTLu/ywZ8wqmtJxIPaNFTHGdOo0KFmfKhjzJVWzKGMhNRzCS6gXUsjtH6uz84UMCce eNYA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=canonical.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q72si12101637iod.204.2018.01.22.14.24.54; Mon, 22 Jan 2018 14:25:06 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=canonical.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751077AbeAVWY2 (ORCPT + 99 others); Mon, 22 Jan 2018 17:24:28 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:46077 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750996AbeAVWY0 (ORCPT ); Mon, 22 Jan 2018 17:24:26 -0500 Received: from mail-io0-f197.google.com ([209.85.223.197]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1edkVt-0001FJ-8Y for linux-kernel@vger.kernel.org; Mon, 22 Jan 2018 22:24:25 +0000 Received: by mail-io0-f197.google.com with SMTP id e69so11017858iod.17 for ; Mon, 22 Jan 2018 14:24:25 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=W46TmR34o9Vbg9lMyC8Ywqcs1ZwOC2kLOdUppF0Ndhg=; b=DoSJwm9ajAY8tr3kSIhZuaH0LMvLNd3ZlVbOtslCyQ3tnd7fahkAdmeIs3UXoxgNVT rJtXRIdMXgbfOJlc1CeprYcCfY2gOb4Bg4jRmwX1md/kekcoafuelMVKKltP7wiiKcWN 78rvgI6DbcMeGG0hdgM56vAf49R8015qPgkk/n26PCk4fd4Z+mlyZZgcPW7AwKxXpNSq P8H1DYFQbyr3lH59WC8541OMZOmIWR9eAPfuN11rXQOnymbAaP5GfYnxDumpWt95zd+6 9iwqsa4wfR3nlXtC4hRpmD5YpioPs55hBsoIqeV/Tx/p7nG7rEDFO9Dk5KAzUI1ONpa5 68MQ== X-Gm-Message-State: AKwxytcTSouqITLBnlxSYuMKHndg4jymX07LLkJ9sJvfiww5weNDEJ0c xENe09Ci6bAP4R3NvrEGFukRxocNxIMjTvbz2aAKU6PNXH/h8rEuU1k61ZVD+lZyFgVnM2Sx1gs TN6VnUItOu1Vh96uPS5m9G4t2JgNe/OBhBMYnck4uFw== X-Received: by 10.107.135.208 with SMTP id r77mr703965ioi.248.1516659864105; Mon, 22 Jan 2018 14:24:24 -0800 (PST) X-Received: by 10.107.135.208 with SMTP id r77mr703927ioi.248.1516659863714; Mon, 22 Jan 2018 14:24:23 -0800 (PST) Received: from localhost ([2605:a601:aae:1b20:7c38:3d99:33a2:9f15]) by smtp.gmail.com with ESMTPSA id d186sm4225961itd.22.2018.01.22.14.24.22 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 22 Jan 2018 14:24:22 -0800 (PST) Date: Mon, 22 Jan 2018 16:24:22 -0600 From: Seth Forshee To: Alban Crequy Cc: alban@kinvolk.io, dongsu@kinvolk.io, iago@kinvolk.io, linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, miklos@szeredi.hu, viro@zeniv.linux.org.uk, zohar@linux.vnet.ibm.com, dmitry.kasatkin@gmail.com, james.l.morris@oracle.com, serge@hallyn.com, hch@infradead.org Subject: Re: [RFC PATCH v3 2/2] ima: force re-appraisal on filesystems with FS_IMA_NO_CACHE Message-ID: <20180122222422.GB18882@ubuntu-xps13> References: <20180122162452.8756-1-alban@kinvolk.io> <20180122162452.8756-3-alban@kinvolk.io> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180122162452.8756-3-alban@kinvolk.io> User-Agent: Mutt/1.9.2 (2017-12-15) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jan 22, 2018 at 05:24:52PM +0100, Alban Crequy wrote: > From: Alban Crequy > > This patch forces files to be re-measured, re-appraised and re-audited > on file systems with the feature flag FS_IMA_NO_CACHE. In that way, > cached integrity results won't be used. > > How to test this: > > The test I did was using a patched version of the memfs FUSE driver > [1][2] and two very simple "hello-world" programs [4] (prog1 prints > "hello world: 1" and prog2 prints "hello world: 2"). > > I copy prog1 and prog2 in the fuse-memfs mount point, execute them and > check the sha1 hash in > "/sys/kernel/security/ima/ascii_runtime_measurements". > > My patch on the memfs FUSE driver added a backdoor command to serve > prog1 when the kernel asks for prog2 or vice-versa. In this way, I can > exec prog1 and get it to print "hello world: 2" without ever replacing > the file via the VFS, so the kernel is not aware of the change. > > The test was done using the branch "alban/fuse-flag-ima-nocache-v3" [3]. > > Step by step test procedure: > > 1. Mount the memfs FUSE using [2]: > rm -f /tmp/memfs-switch* ; memfs -L DEBUG /mnt/memfs > > 2. Copy prog1 and prog2 using [4] > cp prog1 /mnt/memfs/prog1 > cp prog2 /mnt/memfs/prog2 > > 3. Lookup the files and let the FUSE driver to keep the handles open: > dd if=/mnt/memfs/prog1 bs=1 | (read -n 1 x ; sleep 3600 ) & > dd if=/mnt/memfs/prog2 bs=1 | (read -n 1 x ; sleep 3600 ) & > > 4. Check the 2 programs work correctly: > $ /mnt/memfs/prog1 > hello world: 1 > $ /mnt/memfs/prog2 > hello world: 2 > > 5. Check the measurements for prog1 and prog2: > $ sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ > | grep /mnt/memfs/prog > 10 [...] ima-ng sha1:ac14c9268cd2[...] /mnt/memfs/prog1 > 10 [...] ima-ng sha1:799cb5d1e06d[...] /mnt/memfs/prog2 > > 6. Use the backdoor command in my patched memfs to redirect file > operations on file handle 3 to file handle 2: > rm -f /tmp/memfs-switch* ; touch /tmp/memfs-switch-3-2 > > 7. Check how the FUSE driver serves different content for the files: > $ /mnt/memfs/prog1 > hello world: 2 > $ /mnt/memfs/prog2 > hello world: 2 > > 8. Check the measurements: > sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \ > | grep /mnt/memfs/prog > > Without the patch, there are no new measurements, despite the FUSE > driver having served different executables. > > With the patch, I can see additional measurements for prog1 and prog2 > with the hashes reversed when the FUSE driver served the alternative > content. > > [1] https://github.com/bbengfort/memfs > [2] https://github.com/kinvolk/memfs/commits/alban/switch-files > [3] https://github.com/kinvolk/linux/commits/alban/fuse-flag-ima-nocache-v3 > [4] https://github.com/kinvolk/fuse-userns-patches/commit/cf1f5750cab0 > > Cc: linux-kernel@vger.kernel.org > Cc: linux-integrity@vger.kernel.org > Cc: linux-security-module@vger.kernel.org > Cc: linux-fsdevel@vger.kernel.org > Cc: Miklos Szeredi > Cc: Alexander Viro > Cc: Mimi Zohar > Cc: Dmitry Kasatkin > Cc: James Morris > Cc: "Serge E. Hallyn" > Cc: Seth Forshee > Cc: Christoph Hellwig > Tested-by: Dongsu Park > Signed-off-by: Alban Crequy I like this approach as it doesn't require any IMA policy changes to be effective. I'm not sure about the flag name (in my mind it would describe the fs property and not be specifically giving instructions to IMA), but if others are happy with it I won't complain. Acked-by: Seth Forshee > --- > security/integrity/ima/ima_main.c | 24 ++++++++++++++++++++++-- > 1 file changed, 22 insertions(+), 2 deletions(-) > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > index 6d78cb26784d..8870a7bbe9b9 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -24,6 +24,7 @@ > #include > #include > #include > +#include > > #include "ima.h" > > @@ -228,9 +229,28 @@ static int process_measurement(struct file *file, char *buf, loff_t size, > IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK | > IMA_ACTION_FLAGS); > > - if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) > - /* reset all flags if ima_inode_setxattr was called */ > + /* > + * Reset the measure, appraise and audit cached flags either if: > + * - ima_inode_setxattr was called, or > + * - based on filesystem feature flag > + * forcing the file to be re-evaluated. > + */ > + if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) { > iint->flags &= ~IMA_DONE_MASK; > + } else if (inode->i_sb->s_type->fs_flags & FS_IMA_NO_CACHE) { > + if (action & IMA_MEASURE) { > + iint->measured_pcrs = 0; > + iint->flags &= > + ~(IMA_COLLECTED | IMA_MEASURE | IMA_MEASURED); > + } > + if (action & IMA_APPRAISE) > + iint->flags &= > + ~(IMA_COLLECTED | IMA_APPRAISE | IMA_APPRAISED | > + IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK); > + if (action & IMA_AUDIT) > + iint->flags &= > + ~(IMA_COLLECTED | IMA_AUDIT | IMA_AUDITED); > + } > > /* Determine if already appraised/measured based on bitmask > * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED, > -- > 2.13.6 >