Received: by 2002:a05:6358:11c7:b0:104:8066:f915 with SMTP id i7csp4632038rwl; Mon, 10 Apr 2023 14:23:18 -0700 (PDT) X-Google-Smtp-Source: AKy350Y9rAc8W2csHPX+zh72dOk6NvExhXUhZ+d8zC59uIP63AsPXmRMsKANE1xkPLbexxKf0BHz X-Received: by 2002:a17:902:f2cb:b0:1a1:a8eb:d33e with SMTP id h11-20020a170902f2cb00b001a1a8ebd33emr331868plc.8.1681161798569; Mon, 10 Apr 2023 14:23:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681161798; cv=none; d=google.com; s=arc-20160816; b=erdZlgOSOei26kfLnMPMMAVm2QvHLcAMo/uvOfWDUZAZ/4iCZag04R8fmSjZO0+jES FENkjArT/kwrTLZcY0Xqtcv/K5Ad9UKNseDPaFLZMs4xZc/wDukcZBvGDETyJ1UfVeMY 1bWngOYPPNOVgGHhDraT/Cuq8u7hds3QjYKJXmru6Wtgmun3FHimDwGRMqkNFdrbRscu NRCFv/0aAwoTMNP3NC6G/kSRp/iJ9c+4FO/Vuj+2OjzvSCL8Ep6E9HKAxFIR3Oube62B md/1Ente8vs54bGIwZmGru4vKMpbSi71GYKuU9lAEm6/IsegNGrexNZCj/TF7OPSlL0U YicQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:user-agent:in-reply-to:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :dkim-signature:dkim-filter; bh=xt/fJmUDps/x8ZiTtOAHQtR6GDYm/n5KlqBdwXz+DPQ=; b=KvYOiHQEpBNOT5AUM74orNa8k5qHpzzm344RptNy1HPBmtS6/qv2w6lFfWvv1n5iEA 2GD4qdIIz9Jw9bahNMycLcxwS18y9hRnRfEJXqLlm+7Ce3w4PtHi81w8RPfKJt4Ch3rS 50uS+yzWnRs17MnVs+fJUoe1QtsloOnh30QWD7cuBY4cziOMoZfWMWOmX614VGzbpvrH 2fqv8cbUS00b+0pWDQnXzAFr7LnW3PQy8vr5Q9KWCgJ2Y3JeQviXVuhQcOWI7lJMQzV+ 2YiMZP39bZ/Kv+2Q77UIsgXadp+WMesFKqcqZtiuBQsk2wGPEmFehjiI0mPNo+GgcuvV D+8g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=f9sHGf+I; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c15-20020a63ef4f000000b004fb9330dcfcsi11683550pgk.323.2023.04.10.14.23.06; Mon, 10 Apr 2023 14:23:18 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=f9sHGf+I; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229733AbjDJVWb (ORCPT + 99 others); Mon, 10 Apr 2023 17:22:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229591AbjDJVWa (ORCPT ); Mon, 10 Apr 2023 17:22:30 -0400 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 9C8671BF7; Mon, 10 Apr 2023 14:22:28 -0700 (PDT) Received: by linux.microsoft.com (Postfix, from userid 1052) id 029D62121ED9; Mon, 10 Apr 2023 14:22:28 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 029D62121ED9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1681161748; bh=xt/fJmUDps/x8ZiTtOAHQtR6GDYm/n5KlqBdwXz+DPQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=f9sHGf+IeRjFMcQyEtxUhjJuMUB6nkvfJ9I7x4j6T2Qa2koeH8LT8W41X5kCgdFDQ lmtJJaoaDtX2f7Nksb5/aLLwjtRIhWUdNPAfKKwL8Ev7N24aXZR6jtTOKlRnC94xN0 fC1Szq+H6slLOsQa1kIXqPOAnaeXcyeEJSG4vcpg= Date: Mon, 10 Apr 2023 14:22:27 -0700 From: Fan Wu To: Paul Moore Cc: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-block@vger.kernel.org, dm-devel@redhat.com, linux-audit@redhat.com, roberto.sassu@huawei.com, linux-kernel@vger.kernel.org, Deven Bowers Subject: Re: [RFC PATCH v9 06/16] ipe: add LSM hooks on execution and kernel read Message-ID: <20230410212227.GC18827@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net> References: <1675119451-23180-1-git-send-email-wufan@linux.microsoft.com> <1675119451-23180-7-git-send-email-wufan@linux.microsoft.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Spam-Status: No, score=-17.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,ENV_AND_HDR_SPF_MATCH,RCVD_IN_DNSWL_MED,SPF_HELO_PASS, SPF_PASS,USER_IN_DEF_DKIM_WL,USER_IN_DEF_SPF_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Mar 02, 2023 at 02:05:20PM -0500, Paul Moore wrote: > On Mon, Jan 30, 2023 at 5:59???PM Fan Wu wrote: > > > > From: Deven Bowers > > > > IPE's initial goal is to control both execution and the loading of > > kernel modules based on the system's definition of trust. It > > accomplishes this by plugging into the security hooks for > > bprm_check_security, file_mprotect, mmap_file, kernel_load_data, > > and kernel_read_data. > > > > Signed-off-by: Deven Bowers > > Signed-off-by: Fan Wu > > ... > > > --- > > security/ipe/hooks.c | 169 +++++++++++++++++++++++++++++++++++++++++++ > > security/ipe/hooks.h | 13 ++++ > > security/ipe/ipe.c | 6 ++ > > 3 files changed, 188 insertions(+) > > > > diff --git a/security/ipe/hooks.c b/security/ipe/hooks.c > > index 335b773c7ae1..fd5109e29c76 100644 > > --- a/security/ipe/hooks.c > > +++ b/security/ipe/hooks.c > > @@ -23,3 +23,172 @@ void ipe_sb_free_security(struct super_block *mnt_sb) > > { > > ipe_invalidate_pinned_sb(mnt_sb); > > } > > + > > +/** > > + * ipe_bprm_check_security - ipe security hook function for bprm check. > > + * @bprm: Supplies a pointer to a linux_binprm structure to source the file > > + * being evaluated. > > + * > > + * This LSM hook is called when a binary is loaded through the exec > > + * family of system calls. > > + * Return: > > + * *0 - OK > > + * *!0 - Error > > + */ > > +int ipe_bprm_check_security(struct linux_binprm *bprm) > > +{ > > + struct ipe_eval_ctx ctx = { 0 }; > > + > > + build_eval_ctx(&ctx, bprm->file, ipe_op_exec); > > + return ipe_evaluate_event(&ctx); > > +} > > + > > +/** > > + * ipe_mmap_file - ipe security hook function for mmap check. > > + * @f: File being mmap'd. Can be NULL in the case of anonymous memory. > > + * @reqprot: The requested protection on the mmap, passed from usermode. > > + * @prot: The effective protection on the mmap, resolved from reqprot and > > + * system configuration. > > + * @flags: Unused. > > + * > > + * This hook is called when a file is loaded through the mmap > > + * family of system calls. > > + * > > + * Return: > > + * * 0 - OK > > + * * !0 - Error > > + */ > > +int ipe_mmap_file(struct file *f, unsigned long reqprot, unsigned long prot, > > + unsigned long flags) > > +{ > > + struct ipe_eval_ctx ctx = { 0 }; > > + > > + if (prot & PROT_EXEC || reqprot & PROT_EXEC) { > > Is there a reason why you care about @reqprot? It seems like IPE > would only be interested in the protection flags that the kernel is > actually using. > > I notice that in the `ipe_file_mprotect()` hook you ignore @reqprot, > which I believe is the right thing to do. > Yes I double checked and found that's not necessary, I will remove that. -Fan > > + build_eval_ctx(&ctx, f, ipe_op_exec); > > + return ipe_evaluate_event(&ctx); > > + } > > + > > + return 0; > > +} > > + > > +/** > > + * ipe_file_mprotect - ipe security hook function for mprotect check. > > + * @vma: Existing virtual memory area created by mmap or similar. > > + * @reqprot: The requested protection on the mmap, passed from usermode. > > + * @prot: The effective protection on the mmap, resolved from reqprot and > > + * system configuration. > > + * > > + * This LSM hook is called when a mmap'd region of memory is changing > > + * its protections via mprotect. > > + * > > + * Return: > > + * * 0 - OK > > + * * !0 - Error > > + */ > > +int ipe_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > > + unsigned long prot) > > +{ > > + struct ipe_eval_ctx ctx = { 0 }; > > + > > + /* Already Executable */ > > + if (vma->vm_flags & VM_EXEC) > > + return 0; > > + > > + if (prot & PROT_EXEC) { > > + build_eval_ctx(&ctx, vma->vm_file, ipe_op_exec); > > + return ipe_evaluate_event(&ctx); > > + } > > + > > + return 0; > > +} > > + > > +/** > > + * ipe_kernel_read_file - ipe security hook function for kernel read. > > + * @file: Supplies a pointer to the file structure being read in from disk. > > + * @id: Supplies the enumeration identifying the purpose of the read. > > + * @contents: Unused. > > + * > > + * This LSM hook is called when a file is being read in from disk from > > + * the kernel. > > + * > > + * Return: > > + * 0 - OK > > + * !0 - Error > > + */ > > +int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id, > > + bool contents) > > +{ > > + enum ipe_op_type op; > > + struct ipe_eval_ctx ctx; > > + > > + switch (id) { > > + case READING_FIRMWARE: > > + op = ipe_op_firmware; > > + break; > > + case READING_MODULE: > > + op = ipe_op_kernel_module; > > + break; > > + case READING_KEXEC_INITRAMFS: > > + op = ipe_op_kexec_initramfs; > > + break; > > + case READING_KEXEC_IMAGE: > > + op = ipe_op_kexec_image; > > + break; > > + case READING_POLICY: > > + op = ipe_op_ima_policy; > > + break; > > + case READING_X509_CERTIFICATE: > > + op = ipe_op_ima_x509; > > + break; > > + default: > > + op = ipe_op_max; > > + WARN(op == ipe_op_max, "no rule setup for enum %d", id); > > + } > > + > > + build_eval_ctx(&ctx, file, op); > > + return ipe_evaluate_event(&ctx); > > +} > > + > > +/** > > + * ipe_kernel_load_data - ipe security hook function for kernel load data. > > + * @id: Supplies the enumeration identifying the purpose of the read. > > + * @contents: Unused. > > + * > > + * This LSM hook is called when a buffer is being read in from disk. > > + * > > + * Return: > > + * * 0 - OK > > + * * !0 - Error > > + */ > > +int ipe_kernel_load_data(enum kernel_load_data_id id, bool contents) > > +{ > > + enum ipe_op_type op; > > + struct ipe_eval_ctx ctx = { 0 }; > > + > > + switch (id) { > > + case LOADING_FIRMWARE: > > + op = ipe_op_firmware; > > + break; > > + case LOADING_MODULE: > > + op = ipe_op_kernel_module; > > + break; > > + case LOADING_KEXEC_INITRAMFS: > > + op = ipe_op_kexec_initramfs; > > + break; > > + case LOADING_KEXEC_IMAGE: > > + op = ipe_op_kexec_image; > > + break; > > + case LOADING_POLICY: > > + op = ipe_op_ima_policy; > > + break; > > + case LOADING_X509_CERTIFICATE: > > + op = ipe_op_ima_x509; > > + break; > > + default: > > + op = ipe_op_max; > > + WARN(op == ipe_op_max, "no rule setup for enum %d", id); > > + } > > + > > + build_eval_ctx(&ctx, NULL, op); > > + return ipe_evaluate_event(&ctx); > > +} > > diff --git a/security/ipe/hooks.h b/security/ipe/hooks.h > > index 30fe455389bf..857cae69678c 100644 > > --- a/security/ipe/hooks.h > > +++ b/security/ipe/hooks.h > > @@ -11,4 +11,17 @@ > > > > void ipe_sb_free_security(struct super_block *mnt_sb); > > > > +int ipe_bprm_check_security(struct linux_binprm *bprm); > > + > > +int ipe_mmap_file(struct file *f, unsigned long reqprot, unsigned long prot, > > + unsigned long flags); > > + > > +int ipe_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > > + unsigned long prot); > > + > > +int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id, > > + bool contents); > > + > > +int ipe_kernel_load_data(enum kernel_load_data_id id, bool contents); > > + > > #endif /* IPE_HOOKS_H */ > > diff --git a/security/ipe/ipe.c b/security/ipe/ipe.c > > index bef923026b50..7af2f942decd 100644 > > --- a/security/ipe/ipe.c > > +++ b/security/ipe/ipe.c > > @@ -4,6 +4,7 @@ > > */ > > > > #include "ipe.h" > > +#include "hooks.h" > > > > bool ipe_enabled; > > > > @@ -12,6 +13,11 @@ static struct lsm_blob_sizes ipe_blobs __lsm_ro_after_init = { > > > > static struct security_hook_list ipe_hooks[] __lsm_ro_after_init = { > > LSM_HOOK_INIT(sb_free_security, ipe_sb_free_security), > > + LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security), > > + LSM_HOOK_INIT(mmap_file, ipe_mmap_file), > > + LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect), > > + LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file), > > + LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data), > > }; > > > > /** > > -- > > 2.39.0 > > -- > paul-moore.com