From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0345EC433F5 for ; Fri, 15 Oct 2021 19:26:30 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 82FE361056 for ; Fri, 15 Oct 2021 19:26:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 82FE361056 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-524-nGQ4KPAtN2y-qfTWuKSCJg-1; Fri, 15 Oct 2021 15:26:27 -0400 X-MC-Unique: nGQ4KPAtN2y-qfTWuKSCJg-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 7BE931005547; Fri, 15 Oct 2021 19:26:22 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 620165D9DE; Fri, 15 Oct 2021 19:26:22 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 389E81806D04; Fri, 15 Oct 2021 19:26:22 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 19FJQ38C025579 for ; Fri, 15 Oct 2021 15:26:03 -0400 Received: by smtp.corp.redhat.com (Postfix) id 5BE1F2166B2F; Fri, 15 Oct 2021 19:26:03 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast06.extmail.prod.ext.rdu2.redhat.com [10.11.55.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 567282166B25 for ; Fri, 15 Oct 2021 19:25:58 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 56C3618A0169 for ; Fri, 15 Oct 2021 19:25:58 +0000 (UTC) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by relay.mimecast.com with ESMTP id us-mta-576-DLs0J4IAMguoYLKAQ5526A-1; Fri, 15 Oct 2021 15:25:54 -0400 X-MC-Unique: DLs0J4IAMguoYLKAQ5526A-1 Received: from [10.137.106.139] (unknown [131.107.159.11]) by linux.microsoft.com (Postfix) with ESMTPSA id 217B720B9D2B; Fri, 15 Oct 2021 12:25:53 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 217B720B9D2B Message-ID: <9089bdb0-b28a-9fa0-c510-00fa275af621@linux.microsoft.com> Date: Fri, 15 Oct 2021 12:25:53 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 To: Eric Biggers References: <1634151995-16266-1-git-send-email-deven.desai@linux.microsoft.com> <1634151995-16266-13-git-send-email-deven.desai@linux.microsoft.com> From: Deven Bowers In-Reply-To: X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 19FJQ38C025579 X-loop: dm-devel@redhat.com Cc: axboe@kernel.dk, linux-security-module@vger.kernel.org, tytso@mit.edu, paul@paul-moore.com, snitzer@redhat.com, corbet@lwn.net, jannh@google.com, linux-doc@vger.kernel.org, jmorris@namei.org, eparis@redhat.com, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, dm-devel@redhat.com, linux-audit@redhat.com, linux-fscrypt@vger.kernel.org, agk@redhat.com, serge@hallyn.com Subject: Re: [dm-devel] [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Ck9uIDEwLzEzLzIwMjEgMTI6MjQgUE0sIEVyaWMgQmlnZ2VycyB3cm90ZToKPiBPbiBXZWQsIE9j dCAxMywgMjAyMSBhdCAxMjowNjozMVBNIC0wNzAwLCBkZXZlbi5kZXNhaUBsaW51eC5taWNyb3Nv ZnQuY29tIHdyb3RlOgo+PiBGcm9tOiBGYW4gV3UgPHd1ZmFuQGxpbnV4Lm1pY3Jvc29mdC5jb20+ Cj4+Cj4+IEFkZCBzZWN1cml0eV9pbm9kZV9zZXRzZWN1cml0eSB0byBmc3Zlcml0eSBzaWduYXR1 cmUgdmVyaWZpY2F0aW9uLgo+PiBUaGlzIGNhbiBsZXQgTFNNcyBzYXZlIHRoZSBzaWduYXR1cmUg ZGF0YSBhbmQgZGlnZXN0IGhhc2hlcyBwcm92aWRlZAo+PiBieSBmc3Zlcml0eS4KPiBDYW4geW91 IGVsYWJvcmF0ZSBvbiB3aHkgTFNNcyBuZWVkIHRoaXMgaW5mb3JtYXRpb24/CgpUaGUgcHJvcG9z ZWQgTFNNIChJUEUpIG9mIHRoaXMgc2VyaWVzIHdpbGwgYmUgdGhlIG9ubHkgb25lIHRvIG5lZWQK dGhpcyBpbmZvcm1hdGlvbiBhdCB0aGXCoCBtb21lbnQuIElQReKAmXMgZ29hbCBpcyB0byBoYXZl IHByb3ZpZGUKdHJ1c3QtYmFzZWQgYWNjZXNzIGNvbnRyb2wuIFRydXN0IGFuZCBJbnRlZ3JpdHkg YXJlIHRpZWQgdG9nZXRoZXIsCmFzIHlvdSBjYW5ub3QgcHJvdmUgdHJ1c3Qgd2l0aG91dCBwcm92 aW5nIGludGVncml0eS4KCklQRSBuZWVkcyB0aGUgZGlnZXN0IGluZm9ybWF0aW9uIHRvIGJlIGFi bGUgdG8gY29tcGFyZSBhIGRpZ2VzdApwcm92aWRlZCBieSB0aGUgcG9saWN5IGF1dGhvciwgYWdh aW5zdCB0aGUgZGlnZXN0IGNhbGN1bGF0ZWQgYnkKZnN2ZXJpdHkgdG8gbWFrZSBhIGRlY2lzaW9u IG9uIHdoZXRoZXIgdGhhdCBzcGVjaWZpYyBmaWxlLCByZXByZXNlbnRlZApieSB0aGUgZGlnZXN0 IGlzIGF1dGhvcml6ZWQgZm9yIHRoZSBhY3Rpb25zIHNwZWNpZmllZCBpbiB0aGUgcG9saWN5LgoK QSBtb3JlIGNvbmNyZXRlIGV4YW1wbGUsIGlmIGFuIElQRSBwb2xpY3kgYXV0aG9yIHdyaXRlczoK CiDCoMKgwqAgb3A9RVhFQ1VURSBmc3Zlcml0eV9kaWdlc3Q9PEhleERpZ2VzdCA+IGFjdGlvbj1E RU5ZCgpJUEUgdGFrZXMgdGhlIGRpZ2VzdCBwcm92aWRlZCBieSB0aGlzIHNlY3VyaXR5IGhvb2ss IHN0b3JlcyBpdAppbiBJUEUncyBzZWN1cml0eSBibG9iIG9uIHRoZSBpbm9kZS4gSWYgdGhpcyBm aWxlIGlzIGxhdGVyCmV4ZWN1dGVkLCBJUEUgY29tcGFyZXMgdGhlIGRpZ2VzdCBzdG9yZWQgaW4g dGhlIExTTSBibG9iLApwcm92aWRlZCBieSB0aGlzIGhvb2ssIGFnYWluc3QgPEhleERpZ2VzdD4g aW4gdGhlIHBvbGljeSwgaWYKaXQgbWF0Y2hlcywgaXQgZGVuaWVzIHRoZSBhY2Nlc3MsIHBlcmZv cm1pbmcgYSByZXZvY2F0aW9uCm9mIHRoYXQgZmlsZS4KClRoaXMgYnJpbmdzIG1lIHRvIHlvdXIg bmV4dCBjb21tZW50OgoKID4gVGhlIGRpZ2VzdCBpc24ndCBtZWFuaW5nZnVsIHdpdGhvdXQga25v d2luZyB0aGUgaGFzaCBhbGdvcml0aG0gaXQgdXNlcy4KSXQncyBhdmFpbGFibGUgaGVyZSwgYnV0 IHlvdSBhcmVuJ3QgcGFzc2luZyBpdCB0byB0aGlzIGZ1bmN0aW9uLgoKVGhlIGRpZ2VzdCBpcyBt ZWFuaW5nZnVsIHdpdGhvdXQgdGhlIGFsZ29yaXRobSBpbiB0aGlzIGNhc2UuCklQRSBkb2VzIG5v dCB3YW50IHRvIHJlY2FsY3VsYXRlIGEgZGlnZXN0LCB0aGF04oCZcyBleHBlbnNpdmUgYW5kCmRv ZXNu4oCZdCBwcm92aWRlIGFueSB2YWx1ZS4gSVBFLCBpbiB0aGlzIGNhc2UsIHRyZWF0cyB0aGlz IGFzIGEKYnVmZmVyIHRvIGNvbXBhcmUgdGhlIHBvbGljeS1wcm92aWRlZCBvbmUgYWJvdmUgdG8g bWFrZSBhCnBvbGljeSBkZWNpc2lvbiBhYm91dCBhY2Nlc3MgdG8gdGhlIHJlc291cmNlLgoKPj4g QWxzbyBjaGFuZ2VzIHRoZSBpbXBsZW1lbnRhaW9uIGluc2lkZSB0aGUgaG9vayBmdW5jdGlvbiB0 byBsZXQKPj4gbXVsdGlwbGUgTFNNcyBjYW4gYWRkIGhvb2tzLgo+IFBsZWFzZSBzcGxpdCBmcy92 ZXJpdHkvIGNoYW5nZXMgYW5kIHNlY3VyaXR5LyBjaGFuZ2VzIGludG8gc2VwYXJhdGUgcGF0Y2hl cywgaWYKPiBwb3NzaWJsZS4KClNvcnJ5LCB3aWxsIGRvLCBub3QgYSBwcm9ibGVtLgoKPj4gQEAg LTE3Nyw2ICsxNzgsMTcgQEAgc3RydWN0IGZzdmVyaXR5X2luZm8gKmZzdmVyaXR5X2NyZWF0ZV9p bmZvKGNvbnN0IHN0cnVjdCBpbm9kZSAqaW5vZGUsCj4+ICAgCQlmc3Zlcml0eV9lcnIoaW5vZGUs ICJFcnJvciAlZCBjb21wdXRpbmcgZmlsZSBkaWdlc3QiLCBlcnIpOwo+PiAgIAkJZ290byBvdXQ7 Cj4+ICAgCX0KPj4gKwo+PiArCWVyciA9IHNlY3VyaXR5X2lub2RlX3NldHNlY3VyaXR5KChzdHJ1 Y3QgaW5vZGUgKilpbm9kZSwKPiBJZiBhIG5vbi1jb25zdCBpbm9kZSBpcyBuZWVkZWQsIHBsZWFz ZSBwcm9wYWdhdGUgdGhhdCBpbnRvIHRoZSBjYWxsZXJzIHJhdGhlcgo+IHRoYW4gcmFuZG9tbHkg Y2FzdGluZyBhd2F5IHRoZSBjb25zdC4KPgo+PiArCQkJCQkgRlNfVkVSSVRZX0RJR0VTVF9TRUNf TkFNRSwKPj4gKwkJCQkJIHZpLT5maWxlX2RpZ2VzdCwKPj4gKwkJCQkJIHZpLT50cmVlX3BhcmFt cy5oYXNoX2FsZy0+ZGlnZXN0X3NpemUsCj4+ICsJCQkJCSAwKTsKPj4gQEAgLTg0LDcgKzg1LDkg QEAgaW50IGZzdmVyaXR5X3ZlcmlmeV9zaWduYXR1cmUoY29uc3Qgc3RydWN0IGZzdmVyaXR5X2lu Zm8gKnZpLAo+PiAgIAo+PiAgIAlwcl9kZWJ1ZygiVmFsaWQgc2lnbmF0dXJlIGZvciBmaWxlIGRp Z2VzdCAlczolKnBoTlxuIiwKPj4gICAJCSBoYXNoX2FsZy0+bmFtZSwgaGFzaF9hbGctPmRpZ2Vz dF9zaXplLCB2aS0+ZmlsZV9kaWdlc3QpOwo+PiAtCXJldHVybiAwOwo+PiArCXJldHVybiBzZWN1 cml0eV9pbm9kZV9zZXRzZWN1cml0eSgoc3RydWN0IGlub2RlICopaW5vZGUsCj4+Cj4gTGlrZXdp c2UsIHBsZWFzZSBkb24ndCBjYXN0IGF3YXkgY29uc3QuCgpTb3JyeSwgSSBzaG91bGQndmUgY2F1 Z2h0IHRoZXNlIG15c2VsZi4gSSdsbCBjaGFuZ2UKZnN2ZXJpdHlfY3JlYXRlX2luZm8gdG8gYWNj ZXB0IHRoZSBub24tY29uc3QgaW5vZGUsIGFuZApjaGFuZ2UgZnN2ZXJpdHlfdmVyaWZ5X3NpZ25h dHVyZSB0byBhY2NlcHQgYW4gYWRkaXRpb25hbCBpbm9kZQpzdHJ1Y3QgYXMgdGhlIGZpcnN0IGFy ZyBpbnN0ZWFkIG9mIGNoYW5naW5nIHRoZSBmc3Zlcml0eV9pbmZvCnN0cnVjdHVyZSB0byBoYXZl IGEgbm9uLWNvbnN0IGlub2RlIGZpZWxkLgoKPj4gKwkJCQkJRlNfVkVSSVRZX1NJR05BVFVSRV9T RUNfTkFNRSwKPj4gKwkJCQkJc2lnbmF0dXJlLCBzaWdfc2l6ZSwgMCk7Cj4gVGhpcyBpcyBvbmx5 IGZvciBmcy12ZXJpdHkgYnVpbHQtaW4gc2lnbmF0dXJlcyB3aGljaCBhcmVuJ3QgdGhlIG9ubHkg d2F5IHRvIGRvCj4gc2lnbmF0dXJlcyB3aXRoIGZzLXZlcml0eS4gIEFyZSB5b3Ugc3VyZSB0aGlz IGlzIHdoYXQgeW91J3JlIGxvb2tpbmcgZm9yPwoKQ291bGQgeW91IGVsYWJvcmF0ZSBvbiB0aGUg b3RoZXIgc2lnbmF0dXJlIHR5cGVzIHRoYXQgY2FuIGJlIHVzZWQKd2l0aCBmcy12ZXJpdHk/IEni gJltIDk5JSBzdXJlIHRoaXMgaXMgd2hhdCBJ4oCZbSBsb29raW5nIGZvciBhcyB0aGlzCmlzIGEg c2lnbmF0dXJlIHZhbGlkYXRlZCBpbiB0aGUga2VybmVsIGFnYWluc3QgdGhlIGZzLXZlcml0eSBr ZXlyaW5nCmFzIHBhcnQgb2YgdGhlIOKAnGZzdmVyaXR5IGVuYWJsZeKAnSB1dGlsaXR5LgoKSXQn cyBpbXBvcnRhbnQgdGhhdCB0aGUgc2lnbmF0dXJlIGlzIHZhbGlkYXRlZCBpbiB0aGUga2VybmVs LCBhcwp1c2Vyc3BhY2UgaXMgY29uc2lkZXJlZCB1bnRydXN0ZWQgdW50aWwgdGhlIHNpZ25hdHVy ZSBpcyB2YWxpZGF0ZWQKZm9yIHRoaXMgY2FzZS4KCj4gQ2FuIHlvdSBlbGFib3JhdGUgb24geW91 ciB1c2UgY2FzZSBmb3IgZnMtdmVyaXR5IGJ1aWx0LWluIHNpZ25hdHVyZXMsClN1cmUsIHNpZ25h dHVyZXMsIGxpa2UgZGlnZXN0cywgYWxzbyBwcm92aWRlIGEgd2F5IHRvIHByb3ZlIGludGVncml0 eSwKYW5kIHRoZSB0cnVzdCBjb21wb25lbnQgY29tZXMgZnJvbSB0aGUgdmFsaWRhdGlvbiBhZ2Fp bnN0IHRoZSBrZXlyaW5nLAphcyBvcHBvc2VkIHRvIGEgZml4ZWQgdmFsdWUgaW4gSVBF4oCZcyBw b2xpY3kuIFRoZSB1c2UgY2FzZSBmb3IgZnMtdmVyaXR5CmJ1aWx0LWluIHNpZ25hdHVyZXMgaXMg dGhhdCB3ZSBoYXZlIGEgcncgZXh0NCBmaWxlc3lzdGVtIHRoYXQgaGFzIHNvbWUKZXhlY3V0YWJs ZSBmaWxlcywgYW5kIHdlIHdhbnQgdG8gaGF2ZSBhIGV4ZWN1dGlvbiBwb2xpY3kgKHRocm91Z2gg SVBFKQp0aGF0IG9ubHkgX3RydXN0ZWRfIGV4ZWN1dGFibGVzIGNhbiBydW4uIFBlcmYgaXMgaW1w b3J0YW50IGhlcmUsIGhlbmNlCmZzLXZlcml0eS4KCj4gYW5kIHdoYXQgdGhlIExTTSBob29rIHdp bGwgZG8gd2l0aCB0aGVtPwoKQXQgdGhlIG1vbWVudCwgdGhpcyB3aWxsIGp1c3Qgc2lnbmFsIHRv IElQRSB0aGF0IHRoZXNlIGZzLXZlcml0eSBmaWxlcyB3ZXJlCmVuYWJsZWQgd2l0aCBhIGJ1aWx0 LWluIHNpZ25hdHVyZSBhcyBvcHBvc2VkIHRvIGVuYWJsZWQgd2l0aG91dCBhIHNpZ25hdHVyZS4K SW4gdjcsIGl0IGNvcGllcyB0aGUgc2lnbmF0dXJlIGRhdGEgaW50byBJUEUncyBMU00gYmxvYiBh dHRhY2hlZCB0byB0aGUgCmlub2RlLgpJbiB2OCssIEknbSBjaGFuZ2luZyB0aGlzIHRvIHN0b3Jl IOKAnHRydWXigJ0gaW4gSVBFJ3MgTFNNIGJsb2IgaW5zdGVhZCwgYXMgCmNvcHlpbmcKdGhlIHNp Z25hdHVyZSBkYXRhIGlzIGFuIHVubmVjZXNzYXJ5IHdhc3RlIG9mIHNwYWNlIGFuZCBwb2ludCBv ZiAKZmFpbHVyZS4gVGhpcwpoYXMgYSBfc2xpZ2h0bHlfIGRpZmZlcmVudCBmdW5jdGlvbmFsaXR5 IHRoZW4gZnMudmVyaXR5LnJlcXVpcmVfc2lnbmF0dXJlcywKYmVjYXVzZSBldmVuIGlmIHNvbWVv bmUgd2VyZSB0byBkaXNhYmxlIHRoZSByZXF1aXJlIHNpZ25hdHVyZXMgb3B0aW9uLCBJUEUKd291 bGQgc3RpbGwga25vdyBpZiB0aGVzZSBmaWxlcyB3ZXJlIHNpZ25lZCBvciBub3QgYW5kIGJlIGFi bGUgdG8gbWFrZSB0aGUKYWNjZXNzIGNvbnRyb2wgZGVjaXNpb24gYmFzZWQgSVBFJ3MgcG9saWN5 LgoKVmVyeSBjb25jcmV0ZWx5LCB0aGlzIHBvd2VycyB0aGlzIGtpbmQgb2YgcnVsZSBpbiBJUEU6 CgogwqAgb3A9RVhFQ1VURSBmc3Zlcml0eV9zaWduYXR1cmU9VFJVRSBhY3Rpb249QUxMT1cKCmlm IHRoYXQgZnN2ZXJpdHlfc2lnbmF0dXJlIHZhbHVlIGluIElQReKAmXMgTFNNIGJsb2IgYXR0YWNo ZWQgdG8gdGhlIGlub2RlIGlzCnRydWUsIHRoZW4gZnN2ZXJpdHlfc2lnbmF0dXJlIGluIElQReKA mXMgcG9saWN5IHdpbGwgZXZhbHVhdGUgdG8gdHJ1ZSBhbmQgCm1hdGNoCnRoaXMgcnVsZS4gVGhl IGludmVyc2UgaXMgYWxzbyBhcHBsaWNhYmxlLgoKCi0tCmRtLWRldmVsIG1haWxpbmcgbGlzdApk bS1kZXZlbEByZWRoYXQuY29tCmh0dHBzOi8vbGlzdG1hbi5yZWRoYXQuY29tL21haWxtYW4vbGlz dGluZm8vZG0tZGV2ZWw= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A17C9C433EF for ; Fri, 15 Oct 2021 19:28:11 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 09CFD61056 for ; Fri, 15 Oct 2021 19:28:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 09CFD61056 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-474-8cg367pvMLy13vifs7TKuQ-1; Fri, 15 Oct 2021 15:28:06 -0400 X-MC-Unique: 8cg367pvMLy13vifs7TKuQ-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 70878802575; Fri, 15 Oct 2021 19:28:03 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id C523D57CD0; Fri, 15 Oct 2021 19:28:02 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id E6C184A702; Fri, 15 Oct 2021 19:27:59 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 19FJPuoW025517 for ; Fri, 15 Oct 2021 15:25:56 -0400 Received: by smtp.corp.redhat.com (Postfix) id 88464D7B05; Fri, 15 Oct 2021 19:25:56 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 832ECD7B14 for ; Fri, 15 Oct 2021 19:25:56 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 6C5C1800B29 for ; Fri, 15 Oct 2021 19:25:56 +0000 (UTC) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by relay.mimecast.com with ESMTP id us-mta-576-DLs0J4IAMguoYLKAQ5526A-1; Fri, 15 Oct 2021 15:25:54 -0400 X-MC-Unique: DLs0J4IAMguoYLKAQ5526A-1 Received: from [10.137.106.139] (unknown [131.107.159.11]) by linux.microsoft.com (Postfix) with ESMTPSA id 217B720B9D2B; Fri, 15 Oct 2021 12:25:53 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 217B720B9D2B Message-ID: <9089bdb0-b28a-9fa0-c510-00fa275af621@linux.microsoft.com> Date: Fri, 15 Oct 2021 12:25:53 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 Subject: Re: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature To: Eric Biggers References: <1634151995-16266-1-git-send-email-deven.desai@linux.microsoft.com> <1634151995-16266-13-git-send-email-deven.desai@linux.microsoft.com> From: Deven Bowers In-Reply-To: X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 19FJPuoW025517 X-loop: linux-audit@redhat.com X-Mailman-Approved-At: Fri, 15 Oct 2021 15:27:57 -0400 Cc: axboe@kernel.dk, linux-security-module@vger.kernel.org, tytso@mit.edu, snitzer@redhat.com, corbet@lwn.net, jannh@google.com, linux-doc@vger.kernel.org, jmorris@namei.org, eparis@redhat.com, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, dm-devel@redhat.com, linux-audit@redhat.com, linux-fscrypt@vger.kernel.org, agk@redhat.com, serge@hallyn.com X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Ck9uIDEwLzEzLzIwMjEgMTI6MjQgUE0sIEVyaWMgQmlnZ2VycyB3cm90ZToKPiBPbiBXZWQsIE9j dCAxMywgMjAyMSBhdCAxMjowNjozMVBNIC0wNzAwLCBkZXZlbi5kZXNhaUBsaW51eC5taWNyb3Nv ZnQuY29tIHdyb3RlOgo+PiBGcm9tOiBGYW4gV3UgPHd1ZmFuQGxpbnV4Lm1pY3Jvc29mdC5jb20+ Cj4+Cj4+IEFkZCBzZWN1cml0eV9pbm9kZV9zZXRzZWN1cml0eSB0byBmc3Zlcml0eSBzaWduYXR1 cmUgdmVyaWZpY2F0aW9uLgo+PiBUaGlzIGNhbiBsZXQgTFNNcyBzYXZlIHRoZSBzaWduYXR1cmUg ZGF0YSBhbmQgZGlnZXN0IGhhc2hlcyBwcm92aWRlZAo+PiBieSBmc3Zlcml0eS4KPiBDYW4geW91 IGVsYWJvcmF0ZSBvbiB3aHkgTFNNcyBuZWVkIHRoaXMgaW5mb3JtYXRpb24/CgpUaGUgcHJvcG9z ZWQgTFNNIChJUEUpIG9mIHRoaXMgc2VyaWVzIHdpbGwgYmUgdGhlIG9ubHkgb25lIHRvIG5lZWQK dGhpcyBpbmZvcm1hdGlvbiBhdCB0aGXCoCBtb21lbnQuIElQReKAmXMgZ29hbCBpcyB0byBoYXZl IHByb3ZpZGUKdHJ1c3QtYmFzZWQgYWNjZXNzIGNvbnRyb2wuIFRydXN0IGFuZCBJbnRlZ3JpdHkg YXJlIHRpZWQgdG9nZXRoZXIsCmFzIHlvdSBjYW5ub3QgcHJvdmUgdHJ1c3Qgd2l0aG91dCBwcm92 aW5nIGludGVncml0eS4KCklQRSBuZWVkcyB0aGUgZGlnZXN0IGluZm9ybWF0aW9uIHRvIGJlIGFi bGUgdG8gY29tcGFyZSBhIGRpZ2VzdApwcm92aWRlZCBieSB0aGUgcG9saWN5IGF1dGhvciwgYWdh aW5zdCB0aGUgZGlnZXN0IGNhbGN1bGF0ZWQgYnkKZnN2ZXJpdHkgdG8gbWFrZSBhIGRlY2lzaW9u IG9uIHdoZXRoZXIgdGhhdCBzcGVjaWZpYyBmaWxlLCByZXByZXNlbnRlZApieSB0aGUgZGlnZXN0 IGlzIGF1dGhvcml6ZWQgZm9yIHRoZSBhY3Rpb25zIHNwZWNpZmllZCBpbiB0aGUgcG9saWN5LgoK QSBtb3JlIGNvbmNyZXRlIGV4YW1wbGUsIGlmIGFuIElQRSBwb2xpY3kgYXV0aG9yIHdyaXRlczoK CiDCoMKgwqAgb3A9RVhFQ1VURSBmc3Zlcml0eV9kaWdlc3Q9PEhleERpZ2VzdCA+IGFjdGlvbj1E RU5ZCgpJUEUgdGFrZXMgdGhlIGRpZ2VzdCBwcm92aWRlZCBieSB0aGlzIHNlY3VyaXR5IGhvb2ss IHN0b3JlcyBpdAppbiBJUEUncyBzZWN1cml0eSBibG9iIG9uIHRoZSBpbm9kZS4gSWYgdGhpcyBm aWxlIGlzIGxhdGVyCmV4ZWN1dGVkLCBJUEUgY29tcGFyZXMgdGhlIGRpZ2VzdCBzdG9yZWQgaW4g dGhlIExTTSBibG9iLApwcm92aWRlZCBieSB0aGlzIGhvb2ssIGFnYWluc3QgPEhleERpZ2VzdD4g aW4gdGhlIHBvbGljeSwgaWYKaXQgbWF0Y2hlcywgaXQgZGVuaWVzIHRoZSBhY2Nlc3MsIHBlcmZv cm1pbmcgYSByZXZvY2F0aW9uCm9mIHRoYXQgZmlsZS4KClRoaXMgYnJpbmdzIG1lIHRvIHlvdXIg bmV4dCBjb21tZW50OgoKID4gVGhlIGRpZ2VzdCBpc24ndCBtZWFuaW5nZnVsIHdpdGhvdXQga25v d2luZyB0aGUgaGFzaCBhbGdvcml0aG0gaXQgdXNlcy4KSXQncyBhdmFpbGFibGUgaGVyZSwgYnV0 IHlvdSBhcmVuJ3QgcGFzc2luZyBpdCB0byB0aGlzIGZ1bmN0aW9uLgoKVGhlIGRpZ2VzdCBpcyBt ZWFuaW5nZnVsIHdpdGhvdXQgdGhlIGFsZ29yaXRobSBpbiB0aGlzIGNhc2UuCklQRSBkb2VzIG5v dCB3YW50IHRvIHJlY2FsY3VsYXRlIGEgZGlnZXN0LCB0aGF04oCZcyBleHBlbnNpdmUgYW5kCmRv ZXNu4oCZdCBwcm92aWRlIGFueSB2YWx1ZS4gSVBFLCBpbiB0aGlzIGNhc2UsIHRyZWF0cyB0aGlz IGFzIGEKYnVmZmVyIHRvIGNvbXBhcmUgdGhlIHBvbGljeS1wcm92aWRlZCBvbmUgYWJvdmUgdG8g bWFrZSBhCnBvbGljeSBkZWNpc2lvbiBhYm91dCBhY2Nlc3MgdG8gdGhlIHJlc291cmNlLgoKPj4g QWxzbyBjaGFuZ2VzIHRoZSBpbXBsZW1lbnRhaW9uIGluc2lkZSB0aGUgaG9vayBmdW5jdGlvbiB0 byBsZXQKPj4gbXVsdGlwbGUgTFNNcyBjYW4gYWRkIGhvb2tzLgo+IFBsZWFzZSBzcGxpdCBmcy92 ZXJpdHkvIGNoYW5nZXMgYW5kIHNlY3VyaXR5LyBjaGFuZ2VzIGludG8gc2VwYXJhdGUgcGF0Y2hl cywgaWYKPiBwb3NzaWJsZS4KClNvcnJ5LCB3aWxsIGRvLCBub3QgYSBwcm9ibGVtLgoKPj4gQEAg LTE3Nyw2ICsxNzgsMTcgQEAgc3RydWN0IGZzdmVyaXR5X2luZm8gKmZzdmVyaXR5X2NyZWF0ZV9p bmZvKGNvbnN0IHN0cnVjdCBpbm9kZSAqaW5vZGUsCj4+ICAgCQlmc3Zlcml0eV9lcnIoaW5vZGUs ICJFcnJvciAlZCBjb21wdXRpbmcgZmlsZSBkaWdlc3QiLCBlcnIpOwo+PiAgIAkJZ290byBvdXQ7 Cj4+ICAgCX0KPj4gKwo+PiArCWVyciA9IHNlY3VyaXR5X2lub2RlX3NldHNlY3VyaXR5KChzdHJ1 Y3QgaW5vZGUgKilpbm9kZSwKPiBJZiBhIG5vbi1jb25zdCBpbm9kZSBpcyBuZWVkZWQsIHBsZWFz ZSBwcm9wYWdhdGUgdGhhdCBpbnRvIHRoZSBjYWxsZXJzIHJhdGhlcgo+IHRoYW4gcmFuZG9tbHkg Y2FzdGluZyBhd2F5IHRoZSBjb25zdC4KPgo+PiArCQkJCQkgRlNfVkVSSVRZX0RJR0VTVF9TRUNf TkFNRSwKPj4gKwkJCQkJIHZpLT5maWxlX2RpZ2VzdCwKPj4gKwkJCQkJIHZpLT50cmVlX3BhcmFt cy5oYXNoX2FsZy0+ZGlnZXN0X3NpemUsCj4+ICsJCQkJCSAwKTsKPj4gQEAgLTg0LDcgKzg1LDkg QEAgaW50IGZzdmVyaXR5X3ZlcmlmeV9zaWduYXR1cmUoY29uc3Qgc3RydWN0IGZzdmVyaXR5X2lu Zm8gKnZpLAo+PiAgIAo+PiAgIAlwcl9kZWJ1ZygiVmFsaWQgc2lnbmF0dXJlIGZvciBmaWxlIGRp Z2VzdCAlczolKnBoTlxuIiwKPj4gICAJCSBoYXNoX2FsZy0+bmFtZSwgaGFzaF9hbGctPmRpZ2Vz dF9zaXplLCB2aS0+ZmlsZV9kaWdlc3QpOwo+PiAtCXJldHVybiAwOwo+PiArCXJldHVybiBzZWN1 cml0eV9pbm9kZV9zZXRzZWN1cml0eSgoc3RydWN0IGlub2RlICopaW5vZGUsCj4+Cj4gTGlrZXdp c2UsIHBsZWFzZSBkb24ndCBjYXN0IGF3YXkgY29uc3QuCgpTb3JyeSwgSSBzaG91bGQndmUgY2F1 Z2h0IHRoZXNlIG15c2VsZi4gSSdsbCBjaGFuZ2UKZnN2ZXJpdHlfY3JlYXRlX2luZm8gdG8gYWNj ZXB0IHRoZSBub24tY29uc3QgaW5vZGUsIGFuZApjaGFuZ2UgZnN2ZXJpdHlfdmVyaWZ5X3NpZ25h dHVyZSB0byBhY2NlcHQgYW4gYWRkaXRpb25hbCBpbm9kZQpzdHJ1Y3QgYXMgdGhlIGZpcnN0IGFy ZyBpbnN0ZWFkIG9mIGNoYW5naW5nIHRoZSBmc3Zlcml0eV9pbmZvCnN0cnVjdHVyZSB0byBoYXZl IGEgbm9uLWNvbnN0IGlub2RlIGZpZWxkLgoKPj4gKwkJCQkJRlNfVkVSSVRZX1NJR05BVFVSRV9T RUNfTkFNRSwKPj4gKwkJCQkJc2lnbmF0dXJlLCBzaWdfc2l6ZSwgMCk7Cj4gVGhpcyBpcyBvbmx5 IGZvciBmcy12ZXJpdHkgYnVpbHQtaW4gc2lnbmF0dXJlcyB3aGljaCBhcmVuJ3QgdGhlIG9ubHkg d2F5IHRvIGRvCj4gc2lnbmF0dXJlcyB3aXRoIGZzLXZlcml0eS4gIEFyZSB5b3Ugc3VyZSB0aGlz IGlzIHdoYXQgeW91J3JlIGxvb2tpbmcgZm9yPwoKQ291bGQgeW91IGVsYWJvcmF0ZSBvbiB0aGUg b3RoZXIgc2lnbmF0dXJlIHR5cGVzIHRoYXQgY2FuIGJlIHVzZWQKd2l0aCBmcy12ZXJpdHk/IEni gJltIDk5JSBzdXJlIHRoaXMgaXMgd2hhdCBJ4oCZbSBsb29raW5nIGZvciBhcyB0aGlzCmlzIGEg c2lnbmF0dXJlIHZhbGlkYXRlZCBpbiB0aGUga2VybmVsIGFnYWluc3QgdGhlIGZzLXZlcml0eSBr ZXlyaW5nCmFzIHBhcnQgb2YgdGhlIOKAnGZzdmVyaXR5IGVuYWJsZeKAnSB1dGlsaXR5LgoKSXQn cyBpbXBvcnRhbnQgdGhhdCB0aGUgc2lnbmF0dXJlIGlzIHZhbGlkYXRlZCBpbiB0aGUga2VybmVs LCBhcwp1c2Vyc3BhY2UgaXMgY29uc2lkZXJlZCB1bnRydXN0ZWQgdW50aWwgdGhlIHNpZ25hdHVy ZSBpcyB2YWxpZGF0ZWQKZm9yIHRoaXMgY2FzZS4KCj4gQ2FuIHlvdSBlbGFib3JhdGUgb24geW91 ciB1c2UgY2FzZSBmb3IgZnMtdmVyaXR5IGJ1aWx0LWluIHNpZ25hdHVyZXMsClN1cmUsIHNpZ25h dHVyZXMsIGxpa2UgZGlnZXN0cywgYWxzbyBwcm92aWRlIGEgd2F5IHRvIHByb3ZlIGludGVncml0 eSwKYW5kIHRoZSB0cnVzdCBjb21wb25lbnQgY29tZXMgZnJvbSB0aGUgdmFsaWRhdGlvbiBhZ2Fp bnN0IHRoZSBrZXlyaW5nLAphcyBvcHBvc2VkIHRvIGEgZml4ZWQgdmFsdWUgaW4gSVBF4oCZcyBw b2xpY3kuIFRoZSB1c2UgY2FzZSBmb3IgZnMtdmVyaXR5CmJ1aWx0LWluIHNpZ25hdHVyZXMgaXMg dGhhdCB3ZSBoYXZlIGEgcncgZXh0NCBmaWxlc3lzdGVtIHRoYXQgaGFzIHNvbWUKZXhlY3V0YWJs ZSBmaWxlcywgYW5kIHdlIHdhbnQgdG8gaGF2ZSBhIGV4ZWN1dGlvbiBwb2xpY3kgKHRocm91Z2gg SVBFKQp0aGF0IG9ubHkgX3RydXN0ZWRfIGV4ZWN1dGFibGVzIGNhbiBydW4uIFBlcmYgaXMgaW1w b3J0YW50IGhlcmUsIGhlbmNlCmZzLXZlcml0eS4KCj4gYW5kIHdoYXQgdGhlIExTTSBob29rIHdp bGwgZG8gd2l0aCB0aGVtPwoKQXQgdGhlIG1vbWVudCwgdGhpcyB3aWxsIGp1c3Qgc2lnbmFsIHRv IElQRSB0aGF0IHRoZXNlIGZzLXZlcml0eSBmaWxlcyB3ZXJlCmVuYWJsZWQgd2l0aCBhIGJ1aWx0 LWluIHNpZ25hdHVyZSBhcyBvcHBvc2VkIHRvIGVuYWJsZWQgd2l0aG91dCBhIHNpZ25hdHVyZS4K SW4gdjcsIGl0IGNvcGllcyB0aGUgc2lnbmF0dXJlIGRhdGEgaW50byBJUEUncyBMU00gYmxvYiBh dHRhY2hlZCB0byB0aGUgCmlub2RlLgpJbiB2OCssIEknbSBjaGFuZ2luZyB0aGlzIHRvIHN0b3Jl IOKAnHRydWXigJ0gaW4gSVBFJ3MgTFNNIGJsb2IgaW5zdGVhZCwgYXMgCmNvcHlpbmcKdGhlIHNp Z25hdHVyZSBkYXRhIGlzIGFuIHVubmVjZXNzYXJ5IHdhc3RlIG9mIHNwYWNlIGFuZCBwb2ludCBv ZiAKZmFpbHVyZS4gVGhpcwpoYXMgYSBfc2xpZ2h0bHlfIGRpZmZlcmVudCBmdW5jdGlvbmFsaXR5 IHRoZW4gZnMudmVyaXR5LnJlcXVpcmVfc2lnbmF0dXJlcywKYmVjYXVzZSBldmVuIGlmIHNvbWVv bmUgd2VyZSB0byBkaXNhYmxlIHRoZSByZXF1aXJlIHNpZ25hdHVyZXMgb3B0aW9uLCBJUEUKd291 bGQgc3RpbGwga25vdyBpZiB0aGVzZSBmaWxlcyB3ZXJlIHNpZ25lZCBvciBub3QgYW5kIGJlIGFi bGUgdG8gbWFrZSB0aGUKYWNjZXNzIGNvbnRyb2wgZGVjaXNpb24gYmFzZWQgSVBFJ3MgcG9saWN5 LgoKVmVyeSBjb25jcmV0ZWx5LCB0aGlzIHBvd2VycyB0aGlzIGtpbmQgb2YgcnVsZSBpbiBJUEU6 CgogwqAgb3A9RVhFQ1VURSBmc3Zlcml0eV9zaWduYXR1cmU9VFJVRSBhY3Rpb249QUxMT1cKCmlm IHRoYXQgZnN2ZXJpdHlfc2lnbmF0dXJlIHZhbHVlIGluIElQReKAmXMgTFNNIGJsb2IgYXR0YWNo ZWQgdG8gdGhlIGlub2RlIGlzCnRydWUsIHRoZW4gZnN2ZXJpdHlfc2lnbmF0dXJlIGluIElQReKA mXMgcG9saWN5IHdpbGwgZXZhbHVhdGUgdG8gdHJ1ZSBhbmQgCm1hdGNoCnRoaXMgcnVsZS4gVGhl IGludmVyc2UgaXMgYWxzbyBhcHBsaWNhYmxlLgoKCi0tCkxpbnV4LWF1ZGl0IG1haWxpbmcgbGlz dApMaW51eC1hdWRpdEByZWRoYXQuY29tCmh0dHBzOi8vbGlzdG1hbi5yZWRoYXQuY29tL21haWxt YW4vbGlzdGluZm8vbGludXgtYXVkaXQ= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5F8AC433FE for ; Fri, 15 Oct 2021 19:26:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9513061151 for ; Fri, 15 Oct 2021 19:26:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242726AbhJOT2J (ORCPT ); Fri, 15 Oct 2021 15:28:09 -0400 Received: from linux.microsoft.com ([13.77.154.182]:52008 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242723AbhJOT2B (ORCPT ); Fri, 15 Oct 2021 15:28:01 -0400 Received: from [10.137.106.139] (unknown [131.107.159.11]) by linux.microsoft.com (Postfix) with ESMTPSA id 217B720B9D2B; Fri, 15 Oct 2021 12:25:53 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 217B720B9D2B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1634325953; bh=lQmgAQ2ux0khJOaT354qBFfxeuC7/g4/rZr1otAkgC4=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=SeGCQJZGDEBOlAWSP8SrWSrbF3OxA6pk6Bix/M/DHXZgr9aI33izBdGGXamrmijaS k2sjBkyLvFzajpvdxtMWfkAoGjI2jQcYEkGiDlIE+JEnF+7cai5oGWtR+OFQdQKfzQ QKFYnqu90ONiC7L/6YGYJFJdT8uO8zOe5aCEdBSs= Message-ID: <9089bdb0-b28a-9fa0-c510-00fa275af621@linux.microsoft.com> Date: Fri, 15 Oct 2021 12:25:53 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 Subject: Re: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature Content-Language: en-US To: Eric Biggers Cc: corbet@lwn.net, axboe@kernel.dk, agk@redhat.com, snitzer@redhat.com, tytso@mit.edu, paul@paul-moore.com, eparis@redhat.com, jmorris@namei.org, serge@hallyn.com, jannh@google.com, dm-devel@redhat.com, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-audit@redhat.com, linux-security-module@vger.kernel.org References: <1634151995-16266-1-git-send-email-deven.desai@linux.microsoft.com> <1634151995-16266-13-git-send-email-deven.desai@linux.microsoft.com> From: Deven Bowers In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org On 10/13/2021 12:24 PM, Eric Biggers wrote: > On Wed, Oct 13, 2021 at 12:06:31PM -0700, deven.desai@linux.microsoft.com wrote: >> From: Fan Wu >> >> Add security_inode_setsecurity to fsverity signature verification. >> This can let LSMs save the signature data and digest hashes provided >> by fsverity. > Can you elaborate on why LSMs need this information? The proposed LSM (IPE) of this series will be the only one to need this information at the  moment. IPE’s goal is to have provide trust-based access control. Trust and Integrity are tied together, as you cannot prove trust without proving integrity. IPE needs the digest information to be able to compare a digest provided by the policy author, against the digest calculated by fsverity to make a decision on whether that specific file, represented by the digest is authorized for the actions specified in the policy. A more concrete example, if an IPE policy author writes:     op=EXECUTE fsverity_digest= action=DENY IPE takes the digest provided by this security hook, stores it in IPE's security blob on the inode. If this file is later executed, IPE compares the digest stored in the LSM blob, provided by this hook, against in the policy, if it matches, it denies the access, performing a revocation of that file. This brings me to your next comment: > The digest isn't meaningful without knowing the hash algorithm it uses. It's available here, but you aren't passing it to this function. The digest is meaningful without the algorithm in this case. IPE does not want to recalculate a digest, that’s expensive and doesn’t provide any value. IPE, in this case, treats this as a buffer to compare the policy-provided one above to make a policy decision about access to the resource. >> Also changes the implementaion inside the hook function to let >> multiple LSMs can add hooks. > Please split fs/verity/ changes and security/ changes into separate patches, if > possible. Sorry, will do, not a problem. >> @@ -177,6 +178,17 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode, >> fsverity_err(inode, "Error %d computing file digest", err); >> goto out; >> } >> + >> + err = security_inode_setsecurity((struct inode *)inode, > If a non-const inode is needed, please propagate that into the callers rather > than randomly casting away the const. > >> + FS_VERITY_DIGEST_SEC_NAME, >> + vi->file_digest, >> + vi->tree_params.hash_alg->digest_size, >> + 0); >> @@ -84,7 +85,9 @@ int fsverity_verify_signature(const struct fsverity_info *vi, >> >> pr_debug("Valid signature for file digest %s:%*phN\n", >> hash_alg->name, hash_alg->digest_size, vi->file_digest); >> - return 0; >> + return security_inode_setsecurity((struct inode *)inode, >> > Likewise, please don't cast away const. Sorry, I should've caught these myself. I'll change fsverity_create_info to accept the non-const inode, and change fsverity_verify_signature to accept an additional inode struct as the first arg instead of changing the fsverity_info structure to have a non-const inode field. >> + FS_VERITY_SIGNATURE_SEC_NAME, >> + signature, sig_size, 0); > This is only for fs-verity built-in signatures which aren't the only way to do > signatures with fs-verity. Are you sure this is what you're looking for? Could you elaborate on the other signature types that can be used with fs-verity? I’m 99% sure this is what I’m looking for as this is a signature validated in the kernel against the fs-verity keyring as part of the “fsverity enable” utility. It's important that the signature is validated in the kernel, as userspace is considered untrusted until the signature is validated for this case. > Can you elaborate on your use case for fs-verity built-in signatures, Sure, signatures, like digests, also provide a way to prove integrity, and the trust component comes from the validation against the keyring, as opposed to a fixed value in IPE’s policy. The use case for fs-verity built-in signatures is that we have a rw ext4 filesystem that has some executable files, and we want to have a execution policy (through IPE) that only _trusted_ executables can run. Perf is important here, hence fs-verity. > and what the LSM hook will do with them? At the moment, this will just signal to IPE that these fs-verity files were enabled with a built-in signature as opposed to enabled without a signature. In v7, it copies the signature data into IPE's LSM blob attached to the inode. In v8+, I'm changing this to store “true” in IPE's LSM blob instead, as copying the signature data is an unnecessary waste of space and point of failure. This has a _slightly_ different functionality then fs.verity.require_signatures, because even if someone were to disable the require signatures option, IPE would still know if these files were signed or not and be able to make the access control decision based IPE's policy. Very concretely, this powers this kind of rule in IPE:   op=EXECUTE fsverity_signature=TRUE action=ALLOW if that fsverity_signature value in IPE’s LSM blob attached to the inode is true, then fsverity_signature in IPE’s policy will evaluate to true and match this rule. The inverse is also applicable.