From mboxrd@z Thu Jan 1 00:00:00 1970 From: zohar@linux.vnet.ibm.com (Mimi Zohar) Date: Mon, 05 Feb 2018 10:36:42 -0500 Subject: [RFC PATCH] ima: force the re-evaluation of files on untrusted file systems In-Reply-To: References: <1517838054.3736.49.camel@linux.vnet.ibm.com> Message-ID: <1517845002.3736.72.camel@linux.vnet.ibm.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Mon, 2018-02-05 at 15:24 +0100, Alban Crequy wrote: > On Mon, Feb 5, 2018 at 2:40 PM, Mimi Zohar wrote: > > On filesystems, such as fuse or remote filesystems, that we can not > > detect or rely on the filesystem to tell us when a file has changed, > > always re-measure, re-appraise, and/or re-audit the file. > > > > Signed-of-by: Mimi Zohar > > > > --- > > Hi Miklos, > > > > Was something like this what you had in mind? > > > > Mimi > > --- > > security/integrity/ima/ima_main.c | 12 ++++++++++-- > > 1 file changed, 10 insertions(+), 2 deletions(-) > > > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > > index 6d78cb26784d..a428bd75232e 100644 > > --- a/security/integrity/ima/ima_main.c > > +++ b/security/integrity/ima/ima_main.c > > @@ -170,6 +170,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size, > > int mask, enum ima_hooks func, int opened) > > { > > struct inode *inode = file_inode(file); > > + struct dentry *dentry = file_dentry(file); > > struct integrity_iint_cache *iint = NULL; > > struct ima_template_desc *template_desc; > > char *pathbuf = NULL; > > @@ -228,9 +229,16 @@ static int process_measurement(struct file *file, char *buf, loff_t size, > > IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK | > > IMA_ACTION_FLAGS); > > > > - if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) > > - /* reset all flags if ima_inode_setxattr was called */ > > + /* > > + * Re-measure, re-appraise, and/or re-audit a file, if the security > > + * xattrs changed or if the file is on an untrusted file system > > + * (eg. FUSE, remote filesystems). > > + */ > > + if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags) || > > + (dentry->d_op && dentry->d_op->d_revalidate)) { > > It seems dangerous to rely implicitly on "d_revalidate != NULL". vfat > has a d_revalidate for handling 8.3 filenames but it's not a network > filesystem. Files might be unnecessarily re-evaluated, impacting performance, but I'm not sure that it is dangerous. ?For example, local OCFS2 files are unnecessarily re-evaluated. Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:39802 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753063AbeBEPgv (ORCPT ); Mon, 5 Feb 2018 10:36:51 -0500 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w15FaAYH075117 for ; Mon, 5 Feb 2018 10:36:50 -0500 Received: from e06smtp13.uk.ibm.com (e06smtp13.uk.ibm.com [195.75.94.109]) by mx0b-001b2d01.pphosted.com with ESMTP id 2fxsg61sj0-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 05 Feb 2018 10:36:50 -0500 Received: from localhost by e06smtp13.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 5 Feb 2018 15:36:46 -0000 Subject: Re: [RFC PATCH] ima: force the re-evaluation of files on untrusted file systems From: Mimi Zohar To: Alban Crequy Cc: Miklos Szeredi , Dongsu Park , linux-integrity , linux-security-module , linux-fsdevel Date: Mon, 05 Feb 2018 10:36:42 -0500 In-Reply-To: References: <1517838054.3736.49.camel@linux.vnet.ibm.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Message-Id: <1517845002.3736.72.camel@linux.vnet.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Mon, 2018-02-05 at 15:24 +0100, Alban Crequy wrote: > On Mon, Feb 5, 2018 at 2:40 PM, Mimi Zohar wrote: > > On filesystems, such as fuse or remote filesystems, that we can not > > detect or rely on the filesystem to tell us when a file has changed, > > always re-measure, re-appraise, and/or re-audit the file. > > > > Signed-of-by: Mimi Zohar > > > > --- > > Hi Miklos, > > > > Was something like this what you had in mind? > > > > Mimi > > --- > > security/integrity/ima/ima_main.c | 12 ++++++++++-- > > 1 file changed, 10 insertions(+), 2 deletions(-) > > > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > > index 6d78cb26784d..a428bd75232e 100644 > > --- a/security/integrity/ima/ima_main.c > > +++ b/security/integrity/ima/ima_main.c > > @@ -170,6 +170,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size, > > int mask, enum ima_hooks func, int opened) > > { > > struct inode *inode = file_inode(file); > > + struct dentry *dentry = file_dentry(file); > > struct integrity_iint_cache *iint = NULL; > > struct ima_template_desc *template_desc; > > char *pathbuf = NULL; > > @@ -228,9 +229,16 @@ static int process_measurement(struct file *file, char *buf, loff_t size, > > IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK | > > IMA_ACTION_FLAGS); > > > > - if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) > > - /* reset all flags if ima_inode_setxattr was called */ > > + /* > > + * Re-measure, re-appraise, and/or re-audit a file, if the security > > + * xattrs changed or if the file is on an untrusted file system > > + * (eg. FUSE, remote filesystems). > > + */ > > + if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags) || > > + (dentry->d_op && dentry->d_op->d_revalidate)) { > > It seems dangerous to rely implicitly on "d_revalidate != NULL". vfat > has a d_revalidate for handling 8.3 filenames but it's not a network > filesystem. Files might be unnecessarily re-evaluated, impacting performance, but I'm not sure that it is dangerous.  For example, local OCFS2 files are unnecessarily re-evaluated. Mimi