Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: IMA: policy update LSM rules failed
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Yiyang Su <suyiyang@hotmail.com>,
        Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
        "James Morris <jmorris@namei.org>" 
        <IMCEASUPPORTER-SECURITY+20SUBSYSTEM@EURPRD10.PROD.OUTLOOK.COM>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Date:   Mon, 20 Apr 2020 15:05:49 -0400
In-Reply-To: <AM6PR10MB240500A3E665DAA3807E0BF5C8D40@AM6PR10MB2405.EURPRD10.PROD.OUTLOOK.COM>
References: <AM6PR10MB240500A3E665DAA3807E0BF5C8D40@AM6PR10MB2405.EURPRD10.PROD.OUTLOOK.COM>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <1587409549.5446.1.camel@linux.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, 2020-04-20 at 17:51 +0000, Yiyang Su wrote:
> Hello,
> 
> Current i am using Kernel 4.14.169 and trying to add some LSM rules such as "measure subj_user=_ func=FILE_CHECK mask=MAY_READ" into ima policy, but i cannot update the policy. Same happens by updating for subj_role, subj_type, obj_user, obj_role, and obj_type.
> 
> The issue can be produced:
> ###
> echo "measure subj_user=_ func=INODE_PERM mask=MAY_READ" > /sys/kernel/security/ima/policy
> sh: write error: Invalid argument
> IMA: policy update failed
> 
> [ 1558.886333] audit: type=1805 audit(1587051889.726:28): action="measure" subj_user="_" res=0
> [ 1558.903324] audit: type=1802 audit(1587051889.726:29): pid=255 uid=0 auid=4294967295 ses=4294967295 op="update_policy" cause="invalid-policy" comm="sh" res=0
> [ 1558.917414] audit: type=1300 audit(1587051889.726:29): arch=40000028 syscall=4 per=800000 success=no exit=-22 a0=1 a1=aab98 a2=32 a3=0 items=0 ppid=1 pid=255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 )
> [ 1558.945176] audit: type=1327 audit(1587051889.726:29): proctitle="-sh"
> [ 1558.951699] audit: type=1802 audit(1587051889.736:30): pid=255 uid=0 auid=4294967295 ses=4294967295 op="policy_update" cause="failed" comm="sh" res=0
> ###
> 
> But there is no problem to update a rule such as "measure fowner=55"
> ###
> echo "measure fowner=55" > /sys/kernel/security/ima/policy
> IMA: policy update completed
> ###
> 
> The kernel option CONFIG_IMA_LSM_RULES=y is enabled.

Perhaps the difference isn't the LSM options, but the "func="
definition?  I've never seen "func=INODE_PERM".

Mimi