Messages in this thread | | | Date | Thu, 2 Nov 2023 15:56:51 -0700 | Subject | Re: [PATCH RFC v11 9/19] ipe: add permissive toggle | From | Fan Wu <> |
| |
On 10/23/2023 8:52 PM, Paul Moore wrote: > On Oct 4, 2023 Fan Wu <wufan@linux.microsoft.com> wrote: >> >> IPE, like SELinux, supports a permissive mode. This mode allows policy >> authors to test and evaluate IPE policy without it effecting their >> programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS >> be reported. >> >> This patch adds the following audit records: >> >> audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295 >> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 >> audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295 >> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 >> >> The audit record only emit when the value from the user input is >> different from the current enforce value. >> >> Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com> >> Signed-off-by: Fan Wu <wufan@linux.microsoft.com> >> --- >> v2: >> + Split evaluation loop, access control hooks, >> and evaluation loop from policy parser and userspace >> interface to pass mailing list character limit >> >> v3: >> + Move ipe_load_properties to patch 04. >> + Remove useless 0-initializations >> + Prefix extern variables with ipe_ >> + Remove kernel module parameters, as these are >> exposed through sysctls. >> + Add more prose to the IPE base config option >> help text. >> + Use GFP_KERNEL for audit_log_start. >> + Remove unnecessary caching system. >> + Remove comments from headers >> + Use rcu_access_pointer for rcu-pointer null check >> + Remove usage of reqprot; use prot only. >> + Move policy load and activation audit event to 03/12 >> >> v4: >> + Remove sysctls in favor of securityfs nodes >> + Re-add kernel module parameters, as these are now >> exposed through securityfs. >> + Refactor property audit loop to a separate function. >> >> v5: >> + fix minor grammatical errors >> + do not group rule by curly-brace in audit record, >> reconstruct the exact rule. >> >> v6: >> + No changes >> >> v7: >> + Further split lsm creation into a separate commit from the >> evaluation loop and audit system, for easier review. >> + Propagating changes to support the new ipe_context structure in the >> evaluation loop. >> + Split out permissive functionality into a separate patch for easier >> review. >> + Remove permissive switch compile-time configuration option - this >> is trivial to add later. >> >> v8: >> + Remove "IPE" prefix from permissive audit record >> + align fields to the linux-audit field dictionary. This causes the >> following fields to change: >> enforce -> permissive >> >> + Remove duplicated information correlated with syscall record, that >> will always be present in the audit event. >> + Change audit types: >> + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS >> + There is no significant difference in meaning between >> these types. >> >> v9: >> + Clean up ipe_context related code >> >> v10: >> + Change audit format to comform with the existing format selinux is >> using >> + Remove the audit record emission during init to align with selinux, >> which does not perform this action. >> >> v11: >> + Remove redundant code >> --- >> security/ipe/audit.c | 22 ++++++++++++++ >> security/ipe/audit.h | 1 + >> security/ipe/eval.c | 14 +++++++-- >> security/ipe/eval.h | 1 + >> security/ipe/fs.c | 68 ++++++++++++++++++++++++++++++++++++++++++++ >> 5 files changed, 104 insertions(+), 2 deletions(-) > > ... > >> diff --git a/security/ipe/eval.c b/security/ipe/eval.c >> index 499b6b3338f2..78c54ff1fdd3 100644 >> --- a/security/ipe/eval.c >> +++ b/security/ipe/eval.c >> @@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) >> ipe_audit_match(ctx, match_type, action, rule); >> >> if (action == IPE_ACTION_DENY) >> - return -EACCES; >> + rc = -EACCES; >> + >> + if (!enforcing) >> + rc = 0; > > Why the local @enforcing variable? Why not: > > if (!READ_ONCE(enforce)) > rc = 0; >
Yes the variable is unnecessary, I will remove it. -Fan >> - return 0; >> + return rc; >> } >> >> /** >> @@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb) >> >> module_param(success_audit, bool, 0400); >> MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled"); >> +module_param(enforce, bool, 0400); >> +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode"); > > "enforcing" > > -- > paul-moore.com
| |