Received: by 2002:ab2:69cc:0:b0:1f4:be93:e15a with SMTP id n12csp264599lqp; Fri, 12 Apr 2024 17:59:52 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCUktlYo4ByUgGxhrJRQJ8FzlUTaAMOee6hN12HIv3JysYpb4eJTyy1YPnrp3Luczg/HrxUgRca2s/GeL4jGtUYpJvYZJZfJG5vZieBAQA== X-Google-Smtp-Source: AGHT+IF3KheNywNY/KXpNBcSa5pDzPwOG7yzJg6W2vfCwm3yrx+MkOyKoAd3Fa+TBlRY0L328BCv X-Received: by 2002:ae9:e201:0:b0:78d:646d:e2e7 with SMTP id c1-20020ae9e201000000b0078d646de2e7mr4497868qkc.66.1712969991684; Fri, 12 Apr 2024 17:59:51 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1712969991; cv=pass; d=google.com; s=arc-20160816; b=sA2ywsNOeMD7B8MfypXkY50Q5guI5nd5JgWZa8927mIbU57eIh40JVp62bA4ZYGpcS /eynjOMcHn2wkwj6g8CFr6b1Dl8ZRixbMvl8I1YSii2icDS66A8qWCFB9L0u27mE5xfo Sg/dgSn5pX5Cazysf5AkU9qT1W0G0WMo/YeSmmiGmnRH3YAz1NRDGKGtcqZHDSJ0QTlG 4ScxmO+hhrQn0PaiE2nBq8oH3PR9+J5nL/mXtve1MvAdH/5N/cTmatxgNjnjwSqu/3Uz D5p2rx4g7cOn6vTvylWO9MrI8D5PmfYjCl2Rt48giSg/Xn5oi6VQEcGOXXfbMzMnN61J dt8g== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-id:precedence:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature :dkim-filter; bh=qgzvNluGT9ErOs84m/NcPTB0/hL9GdWaYuhJXNLZjGQ=; fh=X3CtLfbVn+7A3/zG3jR92zQ1H4o+5dWSoXRUsYP5TDs=; b=kKLRXmwR+dKmJrGAiPhN5xTXLZSN2vNNq76YOX0GfOFeGuk+0O28iZx80p7nc2xoTs u/MNdPXelBOt6FTjkPjRDg63uDLakiDduEvgQSUqebauhsiL7iM9hZNmV4c554bgL2lK F7/gkD9F/Ib44+hPlEx4B7CavWyT8Gw1tPJvAaK5si+Sb/XR9HTQlvefDPmRHM7GIaU5 ja+H52pZWWp2cQkpVDamWQqHj/SQQDHehEvNwRtPV2jz8huHzmx16bggAeQ+U3agavAj WunEpNH5exUQB0b5ctzpQu7A4qhY3luO5nFAXyXliHBfTSQSgjljIbZ10OpjQc0JQfSX F0RA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=botUGULx; arc=pass (i=1 spf=pass spfdomain=linux.microsoft.com dkim=pass dkdomain=linux.microsoft.com dmarc=pass fromdomain=linux.microsoft.com); spf=pass (google.com: domain of linux-kernel+bounces-143470-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-143470-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Return-Path: Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [2604:1380:45d1:ec00::1]) by mx.google.com with ESMTPS id g6-20020a05620a13c600b0078be9dbbf33si4996972qkl.384.2024.04.12.17.59.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Apr 2024 17:59:51 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel+bounces-143470-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=botUGULx; arc=pass (i=1 spf=pass spfdomain=linux.microsoft.com dkim=pass dkdomain=linux.microsoft.com dmarc=pass fromdomain=linux.microsoft.com); spf=pass (google.com: domain of linux-kernel+bounces-143470-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-143470-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id 5A2EB1C21742 for ; Sat, 13 Apr 2024 00:59:51 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 89A0C58203; Sat, 13 Apr 2024 00:56:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="botUGULx" Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 62FC110A19; Sat, 13 Apr 2024 00:56:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712969771; cv=none; b=XCThYYAsjnn62mW/Prxt0wtYKogIbgYR62++FF/2rPwOMDb9xSlTM8BkKIzNpP5ardkFIARIitluMpQiy/TfDkYxkeP04bWiciKPdqo1t8hjeyvOi9RSvJ5pD1v+oGqyZY+vDZkX74MGgF6HN/YQ5Szaq8NIi8lpDOkgIYjhpsQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712969771; c=relaxed/simple; bh=cqg4zI114ULLGY12Y1REFW1EBl88e+WSkAYDQuvQW9k=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=t1nlGkDZRR2OOvi7VYX6yRDJgH86iL26YqHXwzYRX5EowwEibV/fbbkpP/Noo1SBfFakfc6f322OeFRWnxONI5PB2vJWNdaSVG7hX/fHblDMRJ0Wav0OUnL6N3kmFOIpm+lsPDEFsribTxkXbLu+fTGYuGrWFypYPBbgsCLuYiE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=botUGULx; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Received: by linux.microsoft.com (Postfix, from userid 1052) id 118B120F3CE8; Fri, 12 Apr 2024 17:56:05 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 118B120F3CE8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1712969766; bh=qgzvNluGT9ErOs84m/NcPTB0/hL9GdWaYuhJXNLZjGQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=botUGULxRYTBBmss87tG/Ar7jisX+G25X+phGjgRv7pzM+cdUdVoBQwepQ/GB7/9K hH/c+dVM7Au3dCzs2g2fsJW2hMUUkJ2OYNKb3fh3be3G7KB8+D3/iueKHBLgtMnmFY RebZnjX2KfGttJ8PJhvSsMBrYohQC7gAQ4BUF7pU= From: Fan Wu To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, fsverity@lists.linux.dev, linux-block@vger.kernel.org, dm-devel@lists.linux.dev, audit@vger.kernel.org, linux-kernel@vger.kernel.org, Deven Bowers , Fan Wu Subject: [PATCH v17 10/21] ipe: add permissive toggle Date: Fri, 12 Apr 2024 17:55:53 -0700 Message-Id: <1712969764-31039-11-git-send-email-wufan@linux.microsoft.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1712969764-31039-1-git-send-email-wufan@linux.microsoft.com> References: <1712969764-31039-1-git-send-email-wufan@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: From: Deven Bowers IPE, like SELinux, supports a permissive mode. This mode allows policy authors to test and evaluate IPE policy without it effecting their programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS be reported. This patch adds the following audit records: audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 The audit record only emit when the value from the user input is different from the current enforce value. Signed-off-by: Deven Bowers Signed-off-by: Fan Wu --- v2: + Split evaluation loop, access control hooks, and evaluation loop from policy parser and userspace interface to pass mailing list character limit v3: + Move ipe_load_properties to patch 04. + Remove useless 0-initializations + Prefix extern variables with ipe_ + Remove kernel module parameters, as these are exposed through sysctls. + Add more prose to the IPE base config option help text. + Use GFP_KERNEL for audit_log_start. + Remove unnecessary caching system. + Remove comments from headers + Use rcu_access_pointer for rcu-pointer null check + Remove usage of reqprot; use prot only. + Move policy load and activation audit event to 03/12 v4: + Remove sysctls in favor of securityfs nodes + Re-add kernel module parameters, as these are now exposed through securityfs. + Refactor property audit loop to a separate function. v5: + fix minor grammatical errors + do not group rule by curly-brace in audit record, reconstruct the exact rule. v6: + No changes v7: + Further split lsm creation into a separate commit from the evaluation loop and audit system, for easier review. + Propagating changes to support the new ipe_context structure in the evaluation loop. + Split out permissive functionality into a separate patch for easier review. + Remove permissive switch compile-time configuration option - this is trivial to add later. v8: + Remove "IPE" prefix from permissive audit record + align fields to the linux-audit field dictionary. This causes the following fields to change: enforce -> permissive + Remove duplicated information correlated with syscall record, that will always be present in the audit event. + Change audit types: + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS + There is no significant difference in meaning between these types. v9: + Clean up ipe_context related code v10: + Change audit format to comform with the existing format selinux is using + Remove the audit record emission during init to align with selinux, which does not perform this action. v11: + Remove redundant code v12: + Remove redundant code v13: + Remove audit format macro v14: + No changes v15: + No changes v16: + No changes v17: + Fix code and documentation style issues --- security/ipe/audit.c | 27 ++++++++++++++++-- security/ipe/audit.h | 1 + security/ipe/eval.c | 11 ++++++-- security/ipe/eval.h | 1 + security/ipe/fs.c | 66 ++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 102 insertions(+), 4 deletions(-) diff --git a/security/ipe/audit.c b/security/ipe/audit.c index 6a3f24665655..a416291ba477 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -93,8 +93,8 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx, if (!ab) return; - audit_log_format(ab, "ipe_op=%s ipe_hook=%s pid=%d comm=", - op, audit_hook_names[ctx->hook], + audit_log_format(ab, "ipe_op=%s ipe_hook=%s enforcing=%d pid=%d comm=", + op, audit_hook_names[ctx->hook], READ_ONCE(enforce), task_tgid_nr(current)); audit_log_untrustedstring(ab, get_task_comm(comm, current)); @@ -212,3 +212,26 @@ void ipe_audit_policy_load(const struct ipe_policy *const p) audit_log_end(ab); } + +/** + * ipe_audit_enforce() - Audit a change in IPE's enforcement state. + * @new_enforce: The new value enforce to be set. + * @old_enforce: The old value currently in enforce. + */ +void ipe_audit_enforce(bool new_enforce, bool old_enforce) +{ + struct audit_buffer *ab; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS); + if (!ab) + return; + + audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS, + "enforcing=%d old_enforcing=%d auid=%u ses=%u" + " enabled=1 old-enabled=1 lsm=ipe res=1", + new_enforce, old_enforce, + from_kuid(&init_user_ns, audit_get_loginuid(current)), + audit_get_sessionid(current)); + + audit_log_end(ab); +} diff --git a/security/ipe/audit.h b/security/ipe/audit.h index 3ba8b8a91541..ed2620846a79 100644 --- a/security/ipe/audit.h +++ b/security/ipe/audit.h @@ -14,5 +14,6 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx, void ipe_audit_policy_load(const struct ipe_policy *const p); void ipe_audit_policy_activation(const struct ipe_policy *const op, const struct ipe_policy *const np); +void ipe_audit_enforce(bool new_enforce, bool old_enforce); #endif /* _IPE_AUDIT_H */ diff --git a/security/ipe/eval.c b/security/ipe/eval.c index 18fd5d8fa03e..dd9064974be6 100644 --- a/security/ipe/eval.c +++ b/security/ipe/eval.c @@ -18,6 +18,7 @@ struct ipe_policy __rcu *ipe_active_policy; bool success_audit; +bool enforce = true; #define FILE_SUPERBLOCK(f) ((f)->f_path.mnt->mnt_sb) @@ -108,6 +109,7 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) enum ipe_action_type action; enum ipe_match match_type; bool match = false; + int rc = 0; rcu_read_lock(); @@ -160,9 +162,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) ipe_audit_match(ctx, match_type, action, rule); if (action == IPE_ACTION_DENY) - return -EACCES; + rc = -EACCES; - return 0; + if (!READ_ONCE(enforce)) + rc = 0; + + return rc; } /* Set the right module name */ @@ -173,3 +178,5 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) module_param(success_audit, bool, 0400); MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled"); +module_param(enforce, bool, 0400); +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode"); diff --git a/security/ipe/eval.h b/security/ipe/eval.h index 42b74a7a7c2b..80b74f55fa69 100644 --- a/security/ipe/eval.h +++ b/security/ipe/eval.h @@ -16,6 +16,7 @@ extern struct ipe_policy __rcu *ipe_active_policy; extern bool success_audit; +extern bool enforce; struct ipe_superblock { bool initramfs; diff --git a/security/ipe/fs.c b/security/ipe/fs.c index 9e410982b759..b52fb6023904 100644 --- a/security/ipe/fs.c +++ b/security/ipe/fs.c @@ -16,6 +16,7 @@ static struct dentry *np __ro_after_init; static struct dentry *root __ro_after_init; struct dentry *policy_root __ro_after_init; static struct dentry *audit_node __ro_after_init; +static struct dentry *enforce_node __ro_after_init; /** * setaudit() - Write handler for the securityfs node, "ipe/success_audit" @@ -65,6 +66,58 @@ static ssize_t getaudit(struct file *f, char __user *data, return simple_read_from_buffer(data, len, offset, result, 1); } +/** + * setenforce() - Write handler for the securityfs node, "ipe/enforce" + * @f: Supplies a file structure representing the securityfs node. + * @data: Supplies a buffer passed to the write syscall. + * @len: Supplies the length of @data. + * @offset: unused. + * + * Return: + * * Length of buffer written - Success + * * %-EPERM - Insufficient permission + */ +static ssize_t setenforce(struct file *f, const char __user *data, + size_t len, loff_t *offset) +{ + int rc = 0; + bool new_value, old_value; + + if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) + return -EPERM; + + old_value = READ_ONCE(enforce); + rc = kstrtobool_from_user(data, len, &new_value); + if (rc) + return rc; + + if (new_value != old_value) { + ipe_audit_enforce(new_value, old_value); + WRITE_ONCE(enforce, new_value); + } + + return len; +} + +/** + * getenforce() - Read handler for the securityfs node, "ipe/enforce" + * @f: Supplies a file structure representing the securityfs node. + * @data: Supplies a buffer passed to the read syscall. + * @len: Supplies the length of @data. + * @offset: unused. + * + * Return: Length of buffer written + */ +static ssize_t getenforce(struct file *f, char __user *data, + size_t len, loff_t *offset) +{ + const char *result; + + result = ((READ_ONCE(enforce)) ? "1" : "0"); + + return simple_read_from_buffer(data, len, offset, result, 1); +} + /** * new_policy() - Write handler for the securityfs node, "ipe/new_policy". * @f: Supplies a file structure representing the securityfs node. @@ -123,6 +176,11 @@ static const struct file_operations audit_fops = { .read = getaudit, }; +static const struct file_operations enforce_fops = { + .write = setenforce, + .read = getenforce, +}; + /** * ipe_init_securityfs() - Initialize IPE's securityfs tree at fsinit. * @@ -149,6 +207,13 @@ static int __init ipe_init_securityfs(void) goto err; } + enforce_node = securityfs_create_file("enforce", 0600, root, NULL, + &enforce_fops); + if (IS_ERR(enforce_node)) { + rc = PTR_ERR(enforce_node); + goto err; + } + policy_root = securityfs_create_dir("policies", root); if (IS_ERR(policy_root)) { rc = PTR_ERR(policy_root); @@ -165,6 +230,7 @@ static int __init ipe_init_securityfs(void) err: securityfs_remove(np); securityfs_remove(policy_root); + securityfs_remove(enforce_node); securityfs_remove(audit_node); securityfs_remove(root); return rc; -- 2.44.0