From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5] helo=mx0a-001b2d01.pphosted.com) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fQKkD-0003mn-2N for kexec@lists.infradead.org; Tue, 05 Jun 2018 22:48:02 +0000 Received: from pps.filterd (m0098413.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w55MiC6d078389 for ; Tue, 5 Jun 2018 18:47:47 -0400 Received: from e06smtp07.uk.ibm.com (e06smtp07.uk.ibm.com [195.75.94.103]) by mx0b-001b2d01.pphosted.com with ESMTP id 2je3988m1r-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 05 Jun 2018 18:47:47 -0400 Received: from localhost by e06smtp07.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 5 Jun 2018 23:47:45 +0100 Subject: Re: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module From: Mimi Zohar In-Reply-To: References: <1527616920-5415-1-git-send-email-zohar@linux.vnet.ibm.com> <1527616920-5415-9-git-send-email-zohar@linux.vnet.ibm.com> <1527635645.3534.39.camel@linux.vnet.ibm.com> <1527780226.3427.20.camel@linux.vnet.ibm.com> <1528234513.3557.16.camel@linux.vnet.ibm.com> Date: Tue, 05 Jun 2018 18:40:11 -0400 Mime-Version: 1.0 Message-Id: <1528238411.3557.32.camel@linux.vnet.ibm.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "kexec" Errors-To: kexec-bounces+dwmw2=infradead.org@lists.infradead.org To: Kees Cook Cc: Paul Moore , Ard Biesheuvel , Greg Kroah-Hartman , Kexec Mailing List , "Luis R . Rodriguez" , LKML , David Howells , linux-security-module , Eric Biederman , Jeff Vander Stoep , Casey Schaufler , linux-integrity , James Morris , Andres Rodriguez T24gVHVlLCAyMDE4LTA2LTA1IGF0IDE1OjI2IC0wNzAwLCBLZWVzIENvb2sgd3JvdGU6Cj4gT24g VHVlLCBKdW4gNSwgMjAxOCBhdCAyOjM1IFBNLCBNaW1pIFpvaGFyIDx6b2hhckBsaW51eC52bmV0 LmlibS5jb20+IHdyb3RlOgo+ID4gT24gVHVlLCAyMDE4LTA2LTA1IGF0IDEyOjQ1IC0wNzAwLCBL ZWVzIENvb2sgd3JvdGU6Cj4gPgo+ID4+IEFuZCBpZiB5b3UgbXVzdCBoYXZlIGEgc2VwYXJhdGUg ZW51bSwgcGxlYXNlIGNoYW5nZSB0aGlzIHRvIGZhaWwKPiA+PiBjbG9zZWQgaW5zdGVhZCBvZiBv cGVuIChhbmQgbWFyayB0aGUgZmFsbC10aHJvdWdoKToKPiA+Pgo+ID4+IGludCByYyA9IC1FUEVS TTsKPiA+Pgo+ID4+IHN3aXRjaCAoaWQpIHsKPiA+PiBjYXNlIExPQURJTkdfTU9EVUxFOgo+ID4+ ICAgICByYyA9IGxvYWRwaW5fcmVhZF9maWxlKE5VTEwsIFJFQURJTkdfTU9EVUxFKTsKPiA+PiAg ICAgLyogRmFsbC10aHJvdWdoICovCj4gPj4gZGVmYXVsdDoKPiA+PiAgICAgYnJlYWs7Cj4gPj4g fQo+ID4KPiA+IFRoaXMgd2lsbCBmYWlsIHRoZSBzeXNmcyBmaXJtd2FyZSBmYWxsYmFjayBsb2Fk aW5nIGFuZCB0aGUga2V4ZWNfbG9hZAo+ID4gc3lzY2FsbCB3aXRob3V0IGFueSBtZXNzYWdlLCBh cyB5b3UgaGF2ZSBmb3IgaW5pdF9tb2R1bGUuICBJcyB0aGF0Cj4gPiB3aGF0IHlvdSB3YW50Pwo+ IAo+IEknZCBwcmVmZXIgdGhlcmUgYmUgYSBmdWxsIG1hcHBpbmcgb2YgdGhlIGVudW1zIHNvIHRo YXQgZXZlcnl0aGluZwo+IGdldHMgcGFzc2VkIGludG8gbG9hZHBpbl9yZWFkX2ZpbGUoKSA6KQo+ IAo+IENhbiB0aGUgZW51bSBiZSBzaGFyZWQgb3IgaXMgdGhhdCBub25zZW5zaWNhbD8KCkNvbnNp ZGVyaW5nIHRoaXMgaXMgdjQgb2YgdGhlIHBhdGNoIHNldCwgaXQncyBwcmV0dHkgb2J2aW91cyBJ IGRpZApldmVyeXRoaW5nIHBvc3NpYmxlIG5vdCB0byBkZWZpbmUgYSBuZXcgTFNNIGhvb2suIMKg RXZlbiBpZiB3ZSBjYW4ndApyZS11c2UgdGhlIGV4aXN0aW5nIGVudW0sIHdlIGNvdWxkIGRlZmlu ZSB0aGUgbmV3IGVudW0gaW4gdGVybXMKb2bCoF9fa2VybmVsX3JlYWRfZmlsZV9pZC4KCmVudW0g a2VybmVsX2xvYWRfZGF0YV9pZCB7CiAgICAgICAgX19rZXJuZWxfcmVhZF9maWxlX2lkKF9fZGF0 YV9pZF9lbnVtaWZ5KQp9OwoKc3RhdGljIGNvbnN0IGNoYXIgKiBjb25zdCBrZXJuZWxfbG9hZF9k YXRhX3N0cltdID0gewogICAgICAgIF9fa2VybmVsX3JlYWRfZmlsZV9pZChfX2RhdGFfaWRfc3Ry aW5naWZ5KQp9OwoKRXJpYywgU2VyZ2UsIHdvdWxkIHVzaW5nIGVpdGhlciB0aGUgZXhpc3Rpbmcg X19rZXJuZWxfcmVhZF9maWxlX2lkCmVudW0gb3IgdGhlIGFib3ZlIGRlZmluaXRpb25zIGJlIGFj Y2VwdGFibGU/CgpNaW1pCgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18Ka2V4ZWMgbWFpbGluZyBsaXN0CmtleGVjQGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0 cDovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9rZXhlYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:54792 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752166AbeFEWrs (ORCPT ); Tue, 5 Jun 2018 18:47:48 -0400 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w55Mi8gb145952 for ; Tue, 5 Jun 2018 18:47:47 -0400 Received: from e06smtp07.uk.ibm.com (e06smtp07.uk.ibm.com [195.75.94.103]) by mx0b-001b2d01.pphosted.com with ESMTP id 2je3arrjkv-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 05 Jun 2018 18:47:47 -0400 Received: from localhost by e06smtp07.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 5 Jun 2018 23:47:45 +0100 Subject: Re: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module From: Mimi Zohar To: Kees Cook Cc: Paul Moore , linux-integrity , linux-security-module , LKML , David Howells , "Luis R . Rodriguez" , Eric Biederman , Kexec Mailing List , Andres Rodriguez , Greg Kroah-Hartman , Ard Biesheuvel , Jeff Vander Stoep , Casey Schaufler , James Morris In-Reply-To: References: <1527616920-5415-1-git-send-email-zohar@linux.vnet.ibm.com> <1527616920-5415-9-git-send-email-zohar@linux.vnet.ibm.com> <1527635645.3534.39.camel@linux.vnet.ibm.com> <1527780226.3427.20.camel@linux.vnet.ibm.com> <1528234513.3557.16.camel@linux.vnet.ibm.com> Content-Type: text/plain; charset="UTF-8" Date: Tue, 05 Jun 2018 18:40:11 -0400 Mime-Version: 1.0 Message-Id: <1528238411.3557.32.camel@linux.vnet.ibm.com> Sender: linux-integrity-owner@vger.kernel.org List-ID: On Tue, 2018-06-05 at 15:26 -0700, Kees Cook wrote: > On Tue, Jun 5, 2018 at 2:35 PM, Mimi Zohar wrote: > > On Tue, 2018-06-05 at 12:45 -0700, Kees Cook wrote: > > > >> And if you must have a separate enum, please change this to fail > >> closed instead of open (and mark the fall-through): > >> > >> int rc = -EPERM; > >> > >> switch (id) { > >> case LOADING_MODULE: > >> rc = loadpin_read_file(NULL, READING_MODULE); > >> /* Fall-through */ > >> default: > >> break; > >> } > > > > This will fail the sysfs firmware fallback loading and the kexec_load > > syscall without any message, as you have for init_module. Is that > > what you want? > > I'd prefer there be a full mapping of the enums so that everything > gets passed into loadpin_read_file() :) > > Can the enum be shared or is that nonsensical? Considering this is v4 of the patch set, it's pretty obvious I did everything possible not to define a new LSM hook. Even if we can't re-use the existing enum, we could define the new enum in terms of __kernel_read_file_id. enum kernel_load_data_id { __kernel_read_file_id(__data_id_enumify) }; static const char * const kernel_load_data_str[] = { __kernel_read_file_id(__data_id_stringify) }; Eric, Serge, would using either the existing __kernel_read_file_id enum or the above definitions be acceptable? Mimi From mboxrd@z Thu Jan 1 00:00:00 1970 From: zohar@linux.vnet.ibm.com (Mimi Zohar) Date: Tue, 05 Jun 2018 18:40:11 -0400 Subject: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module In-Reply-To: References: <1527616920-5415-1-git-send-email-zohar@linux.vnet.ibm.com> <1527616920-5415-9-git-send-email-zohar@linux.vnet.ibm.com> <1527635645.3534.39.camel@linux.vnet.ibm.com> <1527780226.3427.20.camel@linux.vnet.ibm.com> <1528234513.3557.16.camel@linux.vnet.ibm.com> Message-ID: <1528238411.3557.32.camel@linux.vnet.ibm.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Tue, 2018-06-05 at 15:26 -0700, Kees Cook wrote: > On Tue, Jun 5, 2018 at 2:35 PM, Mimi Zohar wrote: > > On Tue, 2018-06-05 at 12:45 -0700, Kees Cook wrote: > > > >> And if you must have a separate enum, please change this to fail > >> closed instead of open (and mark the fall-through): > >> > >> int rc = -EPERM; > >> > >> switch (id) { > >> case LOADING_MODULE: > >> rc = loadpin_read_file(NULL, READING_MODULE); > >> /* Fall-through */ > >> default: > >> break; > >> } > > > > This will fail the sysfs firmware fallback loading and the kexec_load > > syscall without any message, as you have for init_module. Is that > > what you want? > > I'd prefer there be a full mapping of the enums so that everything > gets passed into loadpin_read_file() :) > > Can the enum be shared or is that nonsensical? Considering this is v4 of the patch set, it's pretty obvious I did everything possible not to define a new LSM hook. ?Even if we can't re-use the existing enum, we could define the new enum in terms of?__kernel_read_file_id. enum kernel_load_data_id { __kernel_read_file_id(__data_id_enumify) }; static const char * const kernel_load_data_str[] = { __kernel_read_file_id(__data_id_stringify) }; Eric, Serge, would using either the existing __kernel_read_file_id enum or the above definitions be acceptable? Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932081AbeFEWru (ORCPT ); Tue, 5 Jun 2018 18:47:50 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:56448 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752318AbeFEWrs (ORCPT ); Tue, 5 Jun 2018 18:47:48 -0400 Subject: Re: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module From: Mimi Zohar To: Kees Cook Cc: Paul Moore , linux-integrity , linux-security-module , LKML , David Howells , "Luis R . Rodriguez" , Eric Biederman , Kexec Mailing List , Andres Rodriguez , Greg Kroah-Hartman , Ard Biesheuvel , Jeff Vander Stoep , Casey Schaufler , James Morris In-Reply-To: References: <1527616920-5415-1-git-send-email-zohar@linux.vnet.ibm.com> <1527616920-5415-9-git-send-email-zohar@linux.vnet.ibm.com> <1527635645.3534.39.camel@linux.vnet.ibm.com> <1527780226.3427.20.camel@linux.vnet.ibm.com> <1528234513.3557.16.camel@linux.vnet.ibm.com> Content-Type: text/plain; charset="UTF-8" Date: Tue, 05 Jun 2018 18:40:11 -0400 Mime-Version: 1.0 X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 18060522-0028-0000-0000-000002CD8256 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18060522-0029-0000-0000-000023848935 Message-Id: <1528238411.3557.32.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-06-05_09:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=3 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=917 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1805220000 definitions=main-1806050255 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 2018-06-05 at 15:26 -0700, Kees Cook wrote: > On Tue, Jun 5, 2018 at 2:35 PM, Mimi Zohar wrote: > > On Tue, 2018-06-05 at 12:45 -0700, Kees Cook wrote: > > > >> And if you must have a separate enum, please change this to fail > >> closed instead of open (and mark the fall-through): > >> > >> int rc = -EPERM; > >> > >> switch (id) { > >> case LOADING_MODULE: > >> rc = loadpin_read_file(NULL, READING_MODULE); > >> /* Fall-through */ > >> default: > >> break; > >> } > > > > This will fail the sysfs firmware fallback loading and the kexec_load > > syscall without any message, as you have for init_module. Is that > > what you want? > > I'd prefer there be a full mapping of the enums so that everything > gets passed into loadpin_read_file() :) > > Can the enum be shared or is that nonsensical? Considering this is v4 of the patch set, it's pretty obvious I did everything possible not to define a new LSM hook.  Even if we can't re-use the existing enum, we could define the new enum in terms of __kernel_read_file_id. enum kernel_load_data_id { __kernel_read_file_id(__data_id_enumify) }; static const char * const kernel_load_data_str[] = { __kernel_read_file_id(__data_id_stringify) }; Eric, Serge, would using either the existing __kernel_read_file_id enum or the above definitions be acceptable? Mimi