Received-SPF: pass (google.com: domain of linux-kernel+bounces-168854-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Sun, 5 May 2024 07:15:18 +0700
From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Fan Wu <wufan@linux.microsoft.com>, corbet@lwn.net, zohar@linux.ibm.com,
	jmorris@namei.org, serge@hallyn.com, tytso@mit.edu,
	ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com,
	snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com
Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org, fsverity@lists.linux.dev,
	linux-block@vger.kernel.org, dm-devel@lists.linux.dev,
	audit@vger.kernel.org, linux-kernel@vger.kernel.org,
	Deven Bowers <deven.desai@linux.microsoft.com>
Subject: Re: [PATCH v18 20/21] Documentation: add ipe documentation
Message-ID: <ZjbPlk8ZwFZwdqJJ@archie.me>
References: <1714775551-22384-1-git-send-email-wufan@linux.microsoft.com>
 <1714775551-22384-21-git-send-email-wufan@linux.microsoft.com>
 <ZjXsBjAFs-qp9xY4@archie.me>
 <ab7054cd-affd-47c3-bd98-2cf47d6a6376@linux.microsoft.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="InlbHezzGTuEcuIT"
Content-Disposition: inline
In-Reply-To: <ab7054cd-affd-47c3-bd98-2cf47d6a6376@linux.microsoft.com>


--InlbHezzGTuEcuIT
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, May 04, 2024 at 01:13:16PM -0700, Fan Wu wrote:
>=20
>=20
> On 5/4/2024 1:04 AM, Bagas Sanjaya wrote:
> > On Fri, May 03, 2024 at 03:32:30PM -0700, Fan Wu wrote:
> > > +IPE does not mitigate threats arising from malicious but authorized
> > > +developers (with access to a signing certificate), or compromised
> > > +developer tools used by them (i.e. return-oriented programming attac=
ks).
> > > +Additionally, IPE draws hard security boundary between userspace and
> > > +kernelspace. As a result, IPE does not provide any protections again=
st a
> > > +kernel level exploit, and a kernel-level exploit can disable or tamp=
er
> > > +with IPE's protections.
> >=20
> > So how to mitigate kernel-level exploits then?
> >=20
> One possible way is to use hypervisor to protect the kernel integrity.
> https://github.com/heki-linux is one project on this direction. Perhaps I
> should also add this link to the doc.

OK.

>=20
> > > +Allow only initramfs
> > > +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > <snipped>...
> > > +Allow any signed and validated dm-verity volume and the initramfs
> > > +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > <snipped>...
> >=20
> > htmldocs build reports new warnings:
> >=20
> > Documentation/admin-guide/LSM/ipe.rst:694: WARNING: Title underline too=
 short.
> >=20
> > Allow any signed and validated dm-verity volume and the initramfs
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > Documentation/admin-guide/LSM/ipe.rst:694: WARNING: Title underline too=
 short.
> >=20
> > Allow any signed and validated dm-verity volume and the initramfs
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > Documentation/arch/x86/resctrl.rst:577: WARNING: Title underline too sh=
ort.
> >=20
> > I have to match these sections underline length:
> >=20
> > ---- >8 ----
> > diff --git a/Documentation/admin-guide/LSM/ipe.rst b/Documentation/admi=
n-guide/LSM/ipe.rst
> > index 1a3bf1d8aa23f0..a47e14e024a90d 100644
> > --- a/Documentation/admin-guide/LSM/ipe.rst
> > +++ b/Documentation/admin-guide/LSM/ipe.rst
> > @@ -681,7 +681,7 @@ Allow all
> >      DEFAULT action=3DALLOW
> >   Allow only initramfs
> > -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > +~~~~~~~~~~~~~~~~~~~~
> >   ::
> > @@ -691,7 +691,7 @@ Allow only initramfs
> >      op=3DEXECUTE boot_verified=3DTRUE action=3DALLOW
> >   Allow any signed and validated dm-verity volume and the initramfs
> > -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >   ::
> > @@ -725,7 +725,7 @@ Allow only a specific dm-verity volume
> >      op=3DEXECUTE dmverity_roothash=3Dsha256:401fcec5944823ae12f62726e8=
184407a5fa9599783f030dec146938 action=3DALLOW
> >   Allow any fs-verity file with a valid built-in signature
> > -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >   ::
> > @@ -735,7 +735,7 @@ Allow any fs-verity file with a valid built-in sign=
ature
> >      op=3DEXECUTE fsverity_signature=3DTRUE action=3DALLOW
> >   Allow execution of a specific fs-verity file
> > -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >   ::
> >=20
> > > +Additional Information
> > > +----------------------
> > > +
> > > +- `Github Repository <https://github.com/microsoft/ipe>`_
> > > +- Documentation/security/ipe.rst
> >=20
> > Link title to both this admin-side and developer docs can be added for
> > disambiguation (to avoid confusion on readers):
> >=20
> > ---- >8 ----
> > diff --git a/Documentation/admin-guide/LSM/ipe.rst b/Documentation/admi=
n-guide/LSM/ipe.rst
> > index a47e14e024a90d..25b17e11559149 100644
> > --- a/Documentation/admin-guide/LSM/ipe.rst
> > +++ b/Documentation/admin-guide/LSM/ipe.rst
> > @@ -7,7 +7,8 @@ Integrity Policy Enforcement (IPE)
> >      This is the documentation for admins, system builders, or individu=
als
> >      attempting to use IPE. If you're looking for more developer-focused
> > -   documentation about IPE please see Documentation/security/ipe.rst
> > +   documentation about IPE please see :doc:`the design docs
> > +   </security/ipe>`.
> >   Overview
> >   --------
> > @@ -748,7 +749,7 @@ Additional Information
> >   ----------------------
> >   - `Github Repository <https://github.com/microsoft/ipe>`_
> > -- Documentation/security/ipe.rst
> > +- :doc:`Developer and design docs for IPE </security/ipe>`
> >   FAQ
> >   ---
> > diff --git a/Documentation/security/ipe.rst b/Documentation/security/ip=
e.rst
> > index 07e3632241285d..fd1b1a852d2165 100644
> > --- a/Documentation/security/ipe.rst
> > +++ b/Documentation/security/ipe.rst
> > @@ -7,7 +7,7 @@ Integrity Policy Enforcement (IPE) - Kernel Documentati=
on
> >      This is documentation targeted at developers, instead of administr=
ators.
> >      If you're looking for documentation on the usage of IPE, please see
> > -   Documentation/admin-guide/LSM/ipe.rst
> > +   `IPE admin guide </admin-guide/LSM/ipe.rst>`_.
> >   Historical Motivation
> >   ---------------------
> >=20
> > Thanks.
> >=20
>=20
> My apologies for these format issues and thanks for the suggestions. I wi=
ll
> fix them.

Oh, I forgot to also add :doc: directive for the last reference link:

---- >8 ----
diff --git a/Documentation/security/ipe.rst b/Documentation/security/ipe.rst
index fd1b1a852d2165..aa2e64d4119f3e 100644
--- a/Documentation/security/ipe.rst
+++ b/Documentation/security/ipe.rst
@@ -7,7 +7,7 @@ Integrity Policy Enforcement (IPE) - Kernel Documentation
=20
    This is documentation targeted at developers, instead of administrators.
    If you're looking for documentation on the usage of IPE, please see
-   `IPE admin guide </admin-guide/LSM/ipe.rst>`_.
+   :doc:`IPE admin guide </admin-guide/LSM/ipe>`.
=20
 Historical Motivation
 ---------------------

Thanks.

--=20
An old man doll... just what I always wanted! - Clara

--InlbHezzGTuEcuIT
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSSYQ6Cy7oyFNCHrUH2uYlJVVFOowUCZjbPjgAKCRD2uYlJVVFO
o8HPAQDxhozqHxPAtlb/vByqFj4O4DT+qZVm5PvJcv9tnq0aCQD7BQbQr6wEPrYZ
0lIMQIcpVMj+XdMBtixikEDTadIDHQI=
=mp4a
-----END PGP SIGNATURE-----

--InlbHezzGTuEcuIT--