lkml.org 
[lkml]   [2023]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v15 19/26] ima: Namespace audit status flags
    Date
    From: Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com>

    The iint cache stores whether the file is measured, appraised, audited
    etc. This patch moves the IMA_AUDIT and IMA_AUDITED flags into the
    per-namespace ns_status, enabling IMA audit mechanism to audit the same
    file each time it is accessed in a new namespace.

    Read and write operations on the iint flags is replaced with function
    calls. For reading, iint_flags() returns the bitwise OR of iint->flags
    and ns_status->flags. The ns_status flags are masked with
    IMA_NS_STATUS_FLAGS (currently only IMA_AUDIT & IMA_AUDITED) while the
    iint flags are masked with ~IMA_NS_STATUS_FLAGS. Similarly,
    set_iint_flags() writes the one masked portion to the ns_status flags,
    while the iint flags receive the remaining flags. The ns_status
    parameter added to ima_audit_measurement() is used with the above
    functions to query and set the ns_status flags.

    Replace all occurrences where the IMA_AUDITED flag is set with the
    iint_flags() and set_iint_flags() operations so that the splitting
    and merging of the flags works properly. Whenever the IMA_AUDITED flag is
    tested, use iint_flags() to receive the merged version of the flags.

    Since IMA_AUDITED is also part of the IMA_DONE_MASK, use the new
    functions wherever the IMA_DONE_MASK is involved.

    Move the IMA_AUDIT flag also into the ns_status flags since this flag
    is dependent on policy rules that may be different per namespace.

    Signed-off-by: Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com>
    Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

    ---
    v9:
    - Use ns_status also in non-namespaced case and use same flag splitting
    for namespaced and non-namespaced case, thus use one implementation
    for iint_flags() and set_iint_flags()
    - Merge-in patch 'Enable re-auditing of modified files'
    - Use one implementation of mask_iint_ns_status_flags() for namespaced
    and non-namespaced case
    - Added IMA_AUDIT to IMA_NS_STATUS_FLAGS since it's a per namespace flag
    ---
    security/integrity/ima/ima.h | 40 ++++++++++++++++++++--
    security/integrity/ima/ima_api.c | 8 +++--
    security/integrity/ima/ima_main.c | 56 ++++++++++++++++++++++++++-----
    security/integrity/integrity.h | 3 ++
    4 files changed, 94 insertions(+), 13 deletions(-)

    diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
    index 3206d8cb8ca4..4ac937c2c039 100644
    --- a/security/integrity/ima/ima.h
    +++ b/security/integrity/ima/ima.h
    @@ -314,7 +314,8 @@ int process_buffer_measurement(struct ima_namespace *ns,
    int pcr, const char *func_data,
    bool buf_hash, u8 *digest, size_t digest_len);
    void ima_audit_measurement(struct integrity_iint_cache *iint,
    - const unsigned char *filename);
    + const unsigned char *filename,
    + struct ns_status *ns_status);
    int ima_alloc_init_template(struct ima_event_data *event_data,
    struct ima_template_entry **entry,
    struct ima_template_desc *template_desc);
    @@ -498,6 +499,34 @@ static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
    #define POLICY_FILE_FLAGS S_IWUSR
    #endif /* CONFIG_IMA_READ_POLICY */

    +#define IMA_NS_STATUS_ACTIONS IMA_AUDIT
    +#define IMA_NS_STATUS_FLAGS (IMA_AUDIT | IMA_AUDITED)
    +
    +static inline unsigned long iint_flags(struct integrity_iint_cache *iint,
    + struct ns_status *ns_status)
    +{
    + if (!ns_status)
    + return iint->flags;
    +
    + return (iint->flags & ~IMA_NS_STATUS_FLAGS) |
    + (ns_status->flags & IMA_NS_STATUS_FLAGS);
    +}
    +
    +static inline unsigned long set_iint_flags(struct integrity_iint_cache *iint,
    + struct ns_status *ns_status,
    + unsigned long flags)
    +{
    + unsigned long ns_status_flags = flags & IMA_NS_STATUS_FLAGS;
    +
    + WARN_ON(!ns_status && ns_status_flags);
    +
    + iint->flags = flags & ~IMA_NS_STATUS_FLAGS;
    + if (ns_status)
    + ns_status->flags = ns_status_flags;
    +
    + return flags;
    +}
    +
    static inline
    struct user_namespace *ima_user_ns_from_file(const struct file *filp)
    {
    @@ -535,7 +564,14 @@ static inline struct ns_status *ima_get_ns_status
    struct inode *inode,
    struct integrity_iint_cache *iint)
    {
    - return NULL;
    + struct ns_status *ns_status = &iint->ns_status;
    +
    + if (list_empty(&iint->ns_list)) {
    + ns_status_init(ns_status);
    + list_add(&ns_status->ns_next, &iint->ns_list);
    + }
    +
    + return ns_status;
    }

    #endif /* CONFIG_IMA_NS */
    diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
    index 5ea55d172b44..6ca68f6cce01 100644
    --- a/security/integrity/ima/ima_api.c
    +++ b/security/integrity/ima/ima_api.c
    @@ -387,14 +387,16 @@ void ima_store_measurement(struct ima_namespace *ns,
    }

    void ima_audit_measurement(struct integrity_iint_cache *iint,
    - const unsigned char *filename)
    + const unsigned char *filename,
    + struct ns_status *ns_status)
    {
    struct audit_buffer *ab;
    char *hash;
    const char *algo_name = hash_algo_name[iint->ima_hash->algo];
    int i;
    + unsigned long flags = iint_flags(iint, ns_status);

    - if (iint->flags & IMA_AUDITED)
    + if (flags & IMA_AUDITED)
    return;

    hash = kzalloc((iint->ima_hash->length * 2) + 1, GFP_KERNEL);
    @@ -417,7 +419,7 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
    audit_log_task_info(ab);
    audit_log_end(ab);

    - iint->flags |= IMA_AUDITED;
    + set_iint_flags(iint, ns_status, flags | IMA_AUDITED);
    out:
    kfree(hash);
    return;
    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index 55ddf2c8506a..7908acd57e9f 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -149,6 +149,31 @@ static void ima_rdwr_violation_check(struct ima_namespace *ns,
    "invalid_pcr", "open_writers");
    }

    +static void mask_iint_ns_status_flags(struct integrity_iint_cache *iint,
    + unsigned long mask)
    +{
    + struct ns_status *ns_status;
    + unsigned long flags;
    +
    + read_lock(&iint->ns_list_lock);
    + if (list_empty(&iint->ns_list)) {
    + /*
    + * An empty list is possible due to __process_measurement only
    + * creating ns_status for IMA_NS_STATUS_ACTIONS.
    + * No ns_status being used implies that for example IMA_AUDIT
    + * was never used and thus IMA_AUDITED cannot have been set.
    + */
    + flags = iint_flags(iint, NULL) & mask;
    + set_iint_flags(iint, NULL, flags);
    + } else {
    + list_for_each_entry(ns_status, &iint->ns_list, ns_next) {
    + flags = iint_flags(iint, ns_status) & mask;
    + set_iint_flags(iint, ns_status, flags);
    + }
    + }
    + read_unlock(&iint->ns_list_lock);
    +}
    +
    static void ima_check_last_writer(struct integrity_iint_cache *iint,
    struct inode *inode, struct file *file)
    {
    @@ -165,8 +190,11 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
    if (!IS_I_VERSION(inode) ||
    !inode_eq_iversion(inode, iint->version) ||
    (iint->flags & IMA_NEW_FILE)) {
    - iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
    + mask_iint_ns_status_flags
    + (iint,
    + ~(IMA_DONE_MASK | IMA_NEW_FILE));
    iint->measured_pcrs = 0;
    +
    if (update)
    ima_update_xattr(iint, file);
    }
    @@ -203,6 +231,7 @@ static int __process_measurement(struct ima_namespace *ns,
    {
    struct inode *inode = file_inode(file);
    struct integrity_iint_cache *iint = NULL;
    + struct ns_status *ns_status = NULL;
    struct ima_template_desc *template_desc = NULL;
    char *pathbuf = NULL;
    char filename[NAME_MAX];
    @@ -215,6 +244,7 @@ static int __process_measurement(struct ima_namespace *ns,
    bool violation_check;
    enum hash_algo hash_algo;
    unsigned int allowed_algos = 0;
    + unsigned long flags;

    if (!ns->ima_policy_flag || !S_ISREG(inode->i_mode))
    return 0;
    @@ -243,6 +273,14 @@ static int __process_measurement(struct ima_namespace *ns,
    iint = integrity_inode_get(inode);
    if (!iint)
    rc = -ENOMEM;
    +
    + if (!rc && (action & IMA_NS_STATUS_ACTIONS)) {
    + ns_status = ima_get_ns_status(ns, inode, iint);
    + if (IS_ERR(ns_status)) {
    + rc = PTR_ERR(ns_status);
    + ns_status = NULL;
    + }
    + }
    }

    if (!rc && violation_check)
    @@ -258,11 +296,13 @@ static int __process_measurement(struct ima_namespace *ns,

    mutex_lock(&iint->mutex);

    + flags = iint_flags(iint, ns_status);
    +
    if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags))
    /* reset appraisal flags if ima_inode_post_setattr was called */
    - iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED |
    - IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
    - IMA_NONACTION_FLAGS);
    + flags &= ~(IMA_APPRAISE | IMA_APPRAISED |
    + IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
    + IMA_NONACTION_FLAGS);

    /*
    * Re-evaulate the file if either the xattr has changed or the
    @@ -273,7 +313,7 @@ static int __process_measurement(struct ima_namespace *ns,
    ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) &&
    !(inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) &&
    !(action & IMA_FAIL_UNVERIFIABLE_SIGS))) {
    - iint->flags &= ~IMA_DONE_MASK;
    + flags &= ~IMA_DONE_MASK;
    iint->measured_pcrs = 0;
    }

    @@ -281,9 +321,9 @@ static int __process_measurement(struct ima_namespace *ns,
    * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
    * IMA_AUDIT, IMA_AUDITED)
    */
    - iint->flags |= action;
    + flags = set_iint_flags(iint, ns_status, flags | action);
    action &= IMA_DO_MASK;
    - action &= ~((iint->flags & (IMA_DONE_MASK ^ IMA_MEASURED)) >> 1);
    + action &= ~((flags & (IMA_DONE_MASK ^ IMA_MEASURED)) >> 1);

    /* If target pcr is already measured, unset IMA_MEASURE action */
    if ((action & IMA_MEASURE) && (iint->measured_pcrs & (0x1 << pcr)))
    @@ -360,7 +400,7 @@ static int __process_measurement(struct ima_namespace *ns,
    &pathname, filename);
    }
    if (action & IMA_AUDIT)
    - ima_audit_measurement(iint, pathname);
    + ima_audit_measurement(iint, pathname, ns_status);

    if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))
    rc = 0;
    diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
    index 112836d9b33a..50a5d94593e1 100644
    --- a/security/integrity/integrity.h
    +++ b/security/integrity/integrity.h
    @@ -204,6 +204,9 @@ struct integrity_iint_cache {
    */
    rwlock_t ns_list_lock;
    struct list_head ns_list;
    +#ifndef CONFIG_IMA_NS
    + struct ns_status ns_status;
    +#endif
    };

    /* rbtree tree calls to lookup, insert, delete
    --
    2.37.3
    \
     
     \ /
      Last update: 2023-03-27 00:11    [W:4.045 / U:0.160 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site