lkml.org 
[lkml]   [2021]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature
    Date
    From: Fan Wu <wufan@linux.microsoft.com>

    Add security_inode_setsecurity to fsverity signature verification.
    This can let LSMs save the signature data and digest hashes provided
    by fsverity.

    Also changes the implementaion inside the hook function to let
    multiple LSMs can add hooks.

    Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
    Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
    ---
    fs/verity/open.c | 12 ++++++++++++
    fs/verity/signature.c | 5 ++++-
    include/linux/fsverity.h | 3 +++
    security/ipe/hooks.c | 1 +
    security/security.c | 6 +++---
    5 files changed, 23 insertions(+), 4 deletions(-)

    diff --git a/fs/verity/open.c b/fs/verity/open.c
    index 92df87f5fa38..1f36dae01c22 100644
    --- a/fs/verity/open.c
    +++ b/fs/verity/open.c
    @@ -7,6 +7,7 @@

    #include "fsverity_private.h"

    +#include <linux/security.h>
    #include <linux/slab.h>

    static struct kmem_cache *fsverity_info_cachep;
    @@ -177,6 +178,17 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode,
    fsverity_err(inode, "Error %d computing file digest", err);
    goto out;
    }
    +
    + err = security_inode_setsecurity((struct inode *)inode,
    + FS_VERITY_DIGEST_SEC_NAME,
    + vi->file_digest,
    + vi->tree_params.hash_alg->digest_size,
    + 0);
    + if (err) {
    + fsverity_err(inode, "Error %d inode setsecurity hook", err);
    + goto out;
    + }
    +
    pr_debug("Computed file digest: %s:%*phN\n",
    vi->tree_params.hash_alg->name,
    vi->tree_params.digest_size, vi->file_digest);
    diff --git a/fs/verity/signature.c b/fs/verity/signature.c
    index 143a530a8008..20e585d5fa6d 100644
    --- a/fs/verity/signature.c
    +++ b/fs/verity/signature.c
    @@ -9,6 +9,7 @@

    #include <linux/cred.h>
    #include <linux/key.h>
    +#include <linux/security.h>
    #include <linux/slab.h>
    #include <linux/verification.h>

    @@ -84,7 +85,9 @@ int fsverity_verify_signature(const struct fsverity_info *vi,

    pr_debug("Valid signature for file digest %s:%*phN\n",
    hash_alg->name, hash_alg->digest_size, vi->file_digest);
    - return 0;
    + return security_inode_setsecurity((struct inode *)inode,
    + FS_VERITY_SIGNATURE_SEC_NAME,
    + signature, sig_size, 0);
    }

    #ifdef CONFIG_SYSCTL
    diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h
    index b568b3c7d095..dfd7b5a85c67 100644
    --- a/include/linux/fsverity.h
    +++ b/include/linux/fsverity.h
    @@ -233,4 +233,7 @@ static inline bool fsverity_active(const struct inode *inode)
    return fsverity_get_info(inode) != NULL;
    }

    +#define FS_VERITY_SIGNATURE_SEC_NAME "fsverity.verity-sig"
    +#define FS_VERITY_DIGEST_SEC_NAME "fsverity.verity-digest"
    +
    #endif /* _LINUX_FSVERITY_H */
    diff --git a/security/ipe/hooks.c b/security/ipe/hooks.c
    index 470fb48e490c..d76e60a3f511 100644
    --- a/security/ipe/hooks.c
    +++ b/security/ipe/hooks.c
    @@ -232,6 +232,7 @@ void ipe_bdev_free_security(struct block_device *bdev)
    struct ipe_bdev *blob = ipe_bdev(bdev);

    kfree(blob->sigdata);
    + kfree(blob->hash);
    }

    /**
    diff --git a/security/security.c b/security/security.c
    index d7ac9f01500b..81751a91f438 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -1462,7 +1462,7 @@ int security_inode_getsecurity(struct user_namespace *mnt_userns,
    int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
    {
    struct security_hook_list *hp;
    - int rc;
    + int rc = LSM_RET_DEFAULT(inode_setsecurity);

    if (unlikely(IS_PRIVATE(inode)))
    return LSM_RET_DEFAULT(inode_setsecurity);
    @@ -1472,10 +1472,10 @@ int security_inode_setsecurity(struct inode *inode, const char *name, const void
    hlist_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
    rc = hp->hook.inode_setsecurity(inode, name, value, size,
    flags);
    - if (rc != LSM_RET_DEFAULT(inode_setsecurity))
    + if (rc && rc != LSM_RET_DEFAULT(inode_setsecurity))
    return rc;
    }
    - return LSM_RET_DEFAULT(inode_setsecurity);
    + return rc;
    }

    int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
    --
    2.33.0
    \
     
     \ /
      Last update: 2021-10-13 21:08    [W:4.307 / U:0.160 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site