lkml.org 
[lkml]   [2022]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v13 22/26] ima: Introduce securityfs file to activate an IMA namespace
    Date
    Introduce the IMA securityfs file 'active' that users now need to
    write a "1" into (precisely a '1\0' or '1\n') to activate an IMA namespace.
    When reading from the file, it shows either '0' or '1'.

    The rationale for introducing a file to activate an IMA namespace is that
    subsequent support for IMA-measurement and IMA-appraisal will add
    configuration files for selecting for example the template that an IMA
    namespace is supposed to use for logging measurements, which will add
    an IMA namespace configuration stage (using securityfs files) before its
    activation. Besides that it allows to create a user namespace with
    securityfs mounted and an inactive IMA namespace.

    Also, introduce ns_is_active() to be used in those places where the
    ima_namespace pointer may either be NULL or where the active flag may not
    have been set, yet. An inactive IMA namespace should never be accessed
    since it has not been initialized, yet.

    Set the init_ima_ns's active flag since it is considered active right from
    the beginning.

    Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

    ---
    v12:
    - Fixed uninitialized ret if IS_ERR(active) was true

    v11:
    - Move code from ima_fs_add_ns_files() into ima_fs_ns_init()
    - Use ima_ns_flags and IMA_NS_ACTIVE instead of 'atomic_t active'

    v10:
    - use memdup_user_nul to copy input from user
    - propagating error returned from ima_fs_add_ns_files()
    ---
    security/integrity/ima/ima.h | 6 +++
    security/integrity/ima/ima_fs.c | 64 ++++++++++++++++++++++++
    security/integrity/ima/ima_init_ima_ns.c | 1 +
    security/integrity/ima/ima_main.c | 2 +-
    4 files changed, 72 insertions(+), 1 deletion(-)

    diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
    index 6592ae2a4300..fa9f99ad7e69 100644
    --- a/security/integrity/ima/ima.h
    +++ b/security/integrity/ima/ima.h
    @@ -126,6 +126,7 @@ struct ima_namespace {
    unsigned long ima_ns_flags;
    /* Bit numbers for above flags; use BIT() to get flag */
    #define IMA_NS_LSM_UPDATE_RULES 0
    +#define IMA_NS_ACTIVE 1

    struct rb_root ns_status_tree;
    rwlock_t ns_tree_lock;
    @@ -158,6 +159,11 @@ struct ima_namespace {
    } __randomize_layout;
    extern struct ima_namespace init_ima_ns;

    +static inline bool ns_is_active(struct ima_namespace *ns)
    +{
    + return (ns && test_bit(IMA_NS_ACTIVE, &ns->ima_ns_flags));
    +}
    +
    extern const int read_idmap[];

    #ifdef CONFIG_HAVE_IMA_KEXEC
    diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
    index 84cd02a9e19b..301c717e029f 100644
    --- a/security/integrity/ima/ima_fs.c
    +++ b/security/integrity/ima/ima_fs.c
    @@ -451,6 +451,57 @@ static const struct file_operations ima_measure_policy_ops = {
    .llseek = generic_file_llseek,
    };

    +static ssize_t ima_show_active(struct file *filp,
    + char __user *buf,
    + size_t count, loff_t *ppos)
    +{
    + struct ima_namespace *ns = &init_ima_ns;
    + char tmpbuf[2];
    + ssize_t len;
    +
    + len = scnprintf(tmpbuf, sizeof(tmpbuf),
    + "%d\n", !!test_bit(IMA_NS_ACTIVE, &ns->ima_ns_flags));
    + return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
    +}
    +
    +static ssize_t ima_write_active(struct file *filp,
    + const char __user *buf,
    + size_t count, loff_t *ppos)
    +{
    + struct ima_namespace *ns = &init_ima_ns;
    + unsigned int active;
    + char *kbuf;
    + int err;
    +
    + if (ns_is_active(ns))
    + return -EBUSY;
    +
    + /* accepting '1\n' and '1\0' and no partial writes */
    + if (count >= 3 || *ppos != 0)
    + return -EINVAL;
    +
    + kbuf = memdup_user_nul(buf, count);
    + if (IS_ERR(kbuf))
    + return PTR_ERR(kbuf);
    +
    + err = kstrtouint(kbuf, 10, &active);
    + kfree(kbuf);
    + if (err)
    + return err;
    +
    + if (active != 1)
    + return -EINVAL;
    +
    + set_bit(IMA_NS_ACTIVE, &ns->ima_ns_flags);
    +
    + return count;
    +}
    +
    +static const struct file_operations ima_active_ops = {
    + .read = ima_show_active,
    + .write = ima_write_active,
    +};
    +
    int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
    {
    struct ima_namespace *ns = ima_ns_from_user_ns(user_ns);
    @@ -461,6 +512,7 @@ int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
    struct dentry *ascii_runtime_measurements = NULL;
    struct dentry *runtime_measurements_count = NULL;
    struct dentry *violations = NULL;
    + struct dentry *active = NULL;
    int ret;

    /* FIXME: update when evm and integrity are namespaced */
    @@ -531,8 +583,20 @@ int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
    }
    }

    + if (ns != &init_ima_ns) {
    + active =
    + securityfs_create_file("active",
    + S_IRUSR | S_IWUSR | S_IRGRP, ima_dir,
    + NULL, &ima_active_ops);
    + if (IS_ERR(active)) {
    + ret = PTR_ERR(active);
    + goto out;
    + }
    + }
    +
    return 0;
    out:
    + securityfs_remove(active);
    securityfs_remove(ns->ima_policy);
    securityfs_remove(violations);
    securityfs_remove(runtime_measurements_count);
    diff --git a/security/integrity/ima/ima_init_ima_ns.c b/security/integrity/ima/ima_init_ima_ns.c
    index 41e7db0c9749..5c57abfc70ea 100644
    --- a/security/integrity/ima/ima_init_ima_ns.c
    +++ b/security/integrity/ima/ima_init_ima_ns.c
    @@ -58,5 +58,6 @@ struct ima_namespace init_ima_ns = {
    .ima_lsm_policy_notifier = {
    .notifier_call = ima_lsm_policy_change,
    },
    + .ima_ns_flags = BIT(IMA_NS_ACTIVE),
    };
    EXPORT_SYMBOL(init_ima_ns);
    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index 4550958d0f06..c397d24267b7 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -441,7 +441,7 @@ static int process_measurement(struct user_namespace *user_ns,

    while (user_ns) {
    ns = ima_ns_from_user_ns(user_ns);
    - if (ns) {
    + if (ns_is_active(ns)) {
    int rc;

    rc = __process_measurement(ns, file, cred, secid, buf,
    --
    2.36.1
    \
     
     \ /
      Last update: 2022-07-07 16:50    [W:2.329 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site