Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CADG95vuR1=dvgsf6bvNCRNsvDEJ=YwFgfvqJWRkNvD=rrYUaYA@mail.gmail.com>
 <b348c8687d5b40919d8625f4c096d4e2@huawei.com>
In-Reply-To: <b348c8687d5b40919d8625f4c096d4e2@huawei.com>
From:   Bighead Wang <ex200208049@gmail.com>
Date:   Thu, 27 May 2021 11:59:41 +0800
Message-ID: <CADG95vuTMGQY1HbPuHhD9kTEegUBFf75Nen2jPRZq4Xp_51wZw@mail.gmail.com>
Subject: Re: EVM gives no_label error due to security_kernfs_init_security
To:     Roberto Sassu <roberto.sassu@huawei.com>
Cc:     "zohar@linux.ibm.com" <zohar@linux.ibm.com>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Roberto
Thank you for the reply

Before I try this patch, I am sorry that I forget to mention that I
have loaded the EVM HMAC key in initramfs during system bootup.
Therefore, I don't think this patch will fix this issue although I
will give it a try. Because when issue happens, the key has already
loaded.

Thanks !

Roberto Sassu <roberto.sassu@huawei.com> =E6=96=BC 2021=E5=B9=B45=E6=9C=882=
5=E6=97=A5 =E9=80=B1=E4=BA=8C =E4=B8=8B=E5=8D=885:29=E5=AF=AB=E9=81=93=EF=
=BC=9A
>
> > From: Bighead Wang [mailto:ex200208049@gmail.com]
> > Sent: Tuesday, May 25, 2021 11:19 AM
> > In cgroup filesystem, security_kernfs_init_security() will initialize
> > the security data for newly created kernfs node after kernel 5.2.,
> > however, new EVM xattr value is not initialized, and the no_label
> > error appears when evm_verify_hmac() is triggered.
> >
> >
> > The detailed description:
> > When system boots up with IMA/EVM and SELinux enabled, we get:
> > " May 25 14:13:01 raspberrypi audit[1212]: INTEGRITY_METADATA pid=3D121=
2
> > uid=3D0 auid=3D4294967295 ses=3D4294967295 subj=3Dsystem_u:system_r:ini=
t_t
> > op=3Dappraise_metadata cause=3Dno_label comm=3D"(systemd)"
> > name=3D"cgroup.procs" dev=3D"cgroup2" ino=3D1360 res=3D0 errno=3D0 "
> >
> > The root cause is that our customized SELinux file_contexts file does
> > not contain the line "/sys/fs/cgroup/.*     <<none>>".
> > When systemd relabels directories under /sys/fs/cgroup/ during
> > booting, it will set SELinux label inside the iattr member of kernfs
> > node, and then security_kernfs_init_security() will initialize the
> > security data at the time new kernfs node created.
> > After systemd executes something to trigger evm_verify_hmac(), we get
> > this no_label error.
> >
> > In evm_verify_hmac(), if there is no EVM xattr value, it will check
> > any other xattr values protected by EVM exist or not.
> > In this situation, there is no EVM xattr value (got from the iattr
> > member of kernfs node in cgroup filesystem), but SELinux label (also
> > got from the iattr member of kernfs node instead of from inode)
> > exists.
> > To sum up, the error seems to me is EVM mechanism doesn't initialize
> > EVM xattr value in kernfs node.
>
> Hi Hank
>
> this patch should help:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git=
/commit/?h=3Dnext-integrity-testing&id=3D4a804b8a4572dfc81c3a59709d49ae206e=
4370ba
>
> Could you please try it?
>
> Thanks
>
> Roberto
>
> HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
> Managing Director: Li Peng, Li Jian, Shi Yanli
>
> > The environment:
> > /proc/version: Linux version 5.13.0-rc3-v7l+ (bighead@52-0453463-02)
> > (arm-linux-gnueabi-gcc (GCC) 9.1.0, GNU ld (GNU Binutils) 2.32) #1 SMP
> > Tue May 25 12:33:01 CST 2021
> > /proc/sys/kernel/tainted: 0
> > Operating System: Raspbian GNU/Linux 10 (buster)
> > Architecture: armv7l
> > systemd version: systemd 241 (241) +PAM +AUDIT +SELINUX +IMA
> > +APPARMOR
> > +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ
> > +LZ4
> > +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2
> > default-hierarchy=3Dhybrid
> > IMA/EVM kernel parameter: ima_policy=3Dappraise_tcb ima_appraise=3Dfix
> > SELinux kernel parameter: security=3Dselinux selinux=3D1 (permissive mo=
de)
> >
> > How to reproduce the error in Raspbian:
> > 1. Prepare an environment which SELinux and IMA/EVM are enabled and
> > boot up with kernel parameters: security=3Dselinux selinux=3D1
> > ima_policy=3Dappraise_tcb ima_appraise=3Dfix evm=3Dfix
> > 2. Remove the line "/sys/fs/cgroup/.*     <<none>>" in file_contexts
> > file, and fully relabel all system with SELinux official reference
> > policy
> > 3. Walk through all regular files and generate ima/evm hash:
> > /usr/bin/find / -type f -uid 0 -exec sh -c "< '{}'" \;
> > 4. Reboot with kernel parameters: security=3Dselinux selinux=3D1
> > ima_policy=3Dappraise_tcb ima_appraise=3Dfix
> > 5. After boot up, you will get this EVM no_label error message
> >
> > Reproduce the error directly:
> > 1. Prepare an environment which SELinux and IMA/EVM are enabled and
> > boot up with kernel parameters: security=3Dselinux selinux=3D1
> > ima_policy=3Dappraise_tcb ima_appraise=3Dfix evm=3Dfix
> > 2. Fully relabel all system with SELinux official reference policy
> > 3. Walk through all regular files and generate ima/evm hash:
> > /usr/bin/find / -type f -uid 0 -exec sh -c "< '{}'" \;
> > 4. Reboot with kernel parameters: security=3Dselinux selinux=3D1
> > ima_policy=3Dappraise_tcb ima_appraise=3Dfix
> > 5. sudo setfattr -n security.selinux -v system_u:object_r:cgroup_t
> > /sys/fs/cgroup/unified
> > 6. sudo mkdir /sys/fs/cgroup/unified/testevm
> > 7. sudo chmod +x /sys/fs/cgroup/unified/testevm/cgroup.procs: you will
> > get this EVM error message
> >
> > Reference:
> > Kernel config: https://140.96.154.7:5001/sharing/9cPNowmhK
> > Journal log: https://140.96.154.7:5001/sharing/sRISz6IPt
> > Patch for security_kernfs_init_security() :
> > https://lore.kernel.org/selinux/20190130114150.27807-1-
> > omosnace@redhat.com/
> >
> > --
> > Best Regards,
> > Hank Wang


--=20
Best Regards,
=E7=8E=8B=E7=A6=B9=E8=BB=92 Hank