All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Scott Branden <scott.branden@broadcom.com>,
	Kees Cook <keescook@chromium.org>
Cc: rafael@kernel.org, dhowells@redhat.com,
	linux-security-module@vger.kernel.org, paul@paul-moore.com,
	nayna@linux.ibm.com, jmorris@namei.org,
	Christoph Hellwig <hch@infradead.org>,
	geert@linux-m68k.org, dan.carpenter@oracle.com,
	selinux@vger.kernel.org, viro@zeniv.linux.org.uk,
	skhan@linuxfoundation.org, eparis@parisplace.org,
	tglx@linutronix.de, gregkh@linuxfoundation.org,
	stephen.smalley.work@gmail.com, kexec@lists.infradead.org,
	linux-kernel@vger.kernel.org,
	Luis Chamberlain <mcgrof@kernel.org>,
	ebiederm@xmission.com, jeyu@kernel.org,
	linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org,
	bauerman@linux.ibm.com
Subject: Re: [PATCH 0/3] fs: reduce export usage of kerne_read*() calls
Date: Fri, 05 Jun 2020 14:37:18 -0400	[thread overview]
Message-ID: <1591382238.5816.27.camel@linux.ibm.com> (raw)
In-Reply-To: <1c68c0c7-1b0a-dfec-0e50-1b65eedc3dc7@broadcom.com>

On Fri, 2020-06-05 at 11:15 -0700, Scott Branden wrote:
> Hi Mimi,
> 
> On 2020-05-23 7:52 p.m., Mimi Zohar wrote:
> > Scott, the change should be straight forward.  The additional patch
> > needs to:
> > - define a new kernel_read_file_id enumeration, like
> > FIRMWARE_PARTIAL_READ.
> > - Currently ima_read_file() has a comment about pre-allocated firmware
> > buffers.  Update ima_read_file() to call process_measurement() for the
> > new enumeration FIRMWARE_PARTIAL_READ and update ima_post_read_file()
> > to return immediately.
> Should this be what is in ima_read_file?
> {
>      enum ima_hooks func;
>      u32 secid;

Please don't remove the existing comment.

>      if (read_id != READING_FIRMWARE_PARTIAL_READ)
>          return 0;
> 
>      if (!file) { /* should never happen */
>          if (ima_appraise & IMA_APPRAISE_ENFORCE)
>              return -EACCES;
>          return 0;
>      }

This checks for any IMA appraise rule.  You want to enforce firmware
signature checking only if there is a firmware appraise rule.  Refer
to ima_post_read_file().

>      security_task_getsecid(current, &secid);
>      return process_measurement(file, current_cred(), secid, NULL,
>                     0, MAY_READ, FILE_CHECK);

The read_idmap enumeration should be updated similar to the other
firmware.  Keep the code generic.  Refer to ima_post_read_file().
 func will be defined as FIRMWARE_CHECK.

thanks,

Mimi

_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com>
To: Scott Branden <scott.branden@broadcom.com>,
	Kees Cook <keescook@chromium.org>
Cc: Christoph Hellwig <hch@infradead.org>,
	Luis Chamberlain <mcgrof@kernel.org>,
	viro@zeniv.linux.org.uk, gregkh@linuxfoundation.org,
	rafael@kernel.org, ebiederm@xmission.com, jeyu@kernel.org,
	jmorris@namei.org, paul@paul-moore.com,
	stephen.smalley.work@gmail.com, eparis@parisplace.org,
	nayna@linux.ibm.com, dan.carpenter@oracle.com,
	skhan@linuxfoundation.org, geert@linux-m68k.org,
	tglx@linutronix.de, bauerman@linux.ibm.com, dhowells@redhat.com,
	linux-integrity@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	kexec@lists.infradead.org, linux-security-module@vger.kernel.org,
	selinux@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/3] fs: reduce export usage of kerne_read*() calls
Date: Fri, 05 Jun 2020 14:37:18 -0400	[thread overview]
Message-ID: <1591382238.5816.27.camel@linux.ibm.com> (raw)
In-Reply-To: <1c68c0c7-1b0a-dfec-0e50-1b65eedc3dc7@broadcom.com>

On Fri, 2020-06-05 at 11:15 -0700, Scott Branden wrote:
> Hi Mimi,
> 
> On 2020-05-23 7:52 p.m., Mimi Zohar wrote:
> > Scott, the change should be straight forward.  The additional patch
> > needs to:
> > - define a new kernel_read_file_id enumeration, like
> > FIRMWARE_PARTIAL_READ.
> > - Currently ima_read_file() has a comment about pre-allocated firmware
> > buffers.  Update ima_read_file() to call process_measurement() for the
> > new enumeration FIRMWARE_PARTIAL_READ and update ima_post_read_file()
> > to return immediately.
> Should this be what is in ima_read_file?
> {
>      enum ima_hooks func;
>      u32 secid;

Please don't remove the existing comment.

>      if (read_id != READING_FIRMWARE_PARTIAL_READ)
>          return 0;
> 
>      if (!file) { /* should never happen */
>          if (ima_appraise & IMA_APPRAISE_ENFORCE)
>              return -EACCES;
>          return 0;
>      }

This checks for any IMA appraise rule.  You want to enforce firmware
signature checking only if there is a firmware appraise rule.  Refer
to ima_post_read_file().

>      security_task_getsecid(current, &secid);
>      return process_measurement(file, current_cred(), secid, NULL,
>                     0, MAY_READ, FILE_CHECK);

The read_idmap enumeration should be updated similar to the other
firmware.  Keep the code generic.  Refer to ima_post_read_file().
 func will be defined as FIRMWARE_CHECK.

thanks,

Mimi

  reply	other threads:[~2020-06-05 18:37 UTC|newest]

Thread overview: 44+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-13 15:21 [PATCH 0/3] fs: reduce export usage of kerne_read*() calls Luis Chamberlain
2020-05-13 15:21 ` Luis Chamberlain
2020-05-13 15:21 ` [PATCH 1/3] fs: unexport kernel_read_file() Luis Chamberlain
2020-05-13 15:21   ` Luis Chamberlain
2020-05-13 15:21 ` [PATCH 2/3] security: add symbol namespace for reading file data Luis Chamberlain
2020-05-13 15:21   ` Luis Chamberlain
2020-05-13 15:40   ` Eric W. Biederman
2020-05-13 15:40     ` Eric W. Biederman
2020-05-13 16:09     ` Greg KH
2020-05-13 16:09       ` Greg KH
2020-05-13 16:16     ` Luis Chamberlain
2020-05-13 16:16       ` Luis Chamberlain
2020-05-13 16:26       ` Greg KH
2020-05-13 16:26         ` Greg KH
2020-05-13 18:07       ` Josh Triplett
2020-05-13 18:07         ` Josh Triplett
2020-05-13 15:21 ` [PATCH 3/3] fs: move kernel_read*() calls to its own symbol namespace Luis Chamberlain
2020-05-13 15:21   ` Luis Chamberlain
2020-05-13 16:08   ` Greg KH
2020-05-13 16:08     ` Greg KH
2020-05-13 18:17 ` [PATCH 0/3] fs: reduce export usage of kerne_read*() calls Christoph Hellwig
2020-05-13 18:17   ` Christoph Hellwig
2020-05-15 21:29   ` Luis Chamberlain
2020-05-15 21:29     ` Luis Chamberlain
2020-05-18  6:22     ` Christoph Hellwig
2020-05-18  6:22       ` Christoph Hellwig
2020-05-18 12:37       ` Mimi Zohar
2020-05-18 12:37         ` Mimi Zohar
2020-05-18 15:21         ` Kees Cook
2020-05-18 15:21           ` Kees Cook
2020-07-29  1:20           ` Luis Chamberlain
2020-07-29  1:20             ` Luis Chamberlain
2020-05-22 22:24         ` Scott Branden
2020-05-22 22:24           ` Scott Branden
2020-05-22 23:04           ` Kees Cook
2020-05-22 23:04             ` Kees Cook
2020-05-22 23:25             ` Scott Branden
2020-05-22 23:25               ` Scott Branden
2020-05-24  2:52               ` Mimi Zohar
2020-05-24  2:52                 ` Mimi Zohar
2020-06-05 18:15                 ` Scott Branden
2020-06-05 18:15                   ` Scott Branden
2020-06-05 18:37                   ` Mimi Zohar [this message]
2020-06-05 18:37                     ` Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1591382238.5816.27.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=bauerman@linux.ibm.com \
    --cc=dan.carpenter@oracle.com \
    --cc=dhowells@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=eparis@parisplace.org \
    --cc=geert@linux-m68k.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hch@infradead.org \
    --cc=jeyu@kernel.org \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=kexec@lists.infradead.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mcgrof@kernel.org \
    --cc=nayna@linux.ibm.com \
    --cc=paul@paul-moore.com \
    --cc=rafael@kernel.org \
    --cc=scott.branden@broadcom.com \
    --cc=selinux@vger.kernel.org \
    --cc=skhan@linuxfoundation.org \
    --cc=stephen.smalley.work@gmail.com \
    --cc=tglx@linutronix.de \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.