From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9999CEB64D7 for ; Wed, 28 Jun 2023 21:19:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1687987163; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=qrof6mc8079iHZZy25Yuyw0z343qxmd5ARw5Y7i1IbQ=; b=I0QwFBNCx9mWqqBrC60/n2v+GmePk//r4sZlWjebrB0Enase0Z+PkVOcKgu1VO5qquuxtF 9TQgpfqEjSv/c7Ma+WhF+YlFqkVDd4O74vFjLp9eIa2ikVK94s6C8yLd633tPNa+uA4Ka7 peZXOScJjZ2gpTIUMu+2e2rAFsHt46Q= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-335-rloAxV6eMgiTj23CABSA2A-1; Wed, 28 Jun 2023 17:19:15 -0400 X-MC-Unique: rloAxV6eMgiTj23CABSA2A-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A493329DD987; Wed, 28 Jun 2023 21:18:54 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 950B94087C6A; Wed, 28 Jun 2023 21:18:54 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id B26B019452C1; Wed, 28 Jun 2023 21:18:53 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 0393B1946A76 for ; Wed, 28 Jun 2023 21:18:49 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id E9C24111F3C7; Wed, 28 Jun 2023 21:18:48 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast07.extmail.prod.ext.rdu2.redhat.com [10.11.55.23]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E1E6C111F3BB for ; Wed, 28 Jun 2023 21:18:48 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C79BF3C0FCB1 for ; Wed, 28 Jun 2023 21:18:48 +0000 (UTC) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by relay.mimecast.com with ESMTP id us-mta-204-Y-F-8z2iNtmC775KjtfG1w-1; Wed, 28 Jun 2023 17:18:43 -0400 X-MC-Unique: Y-F-8z2iNtmC775KjtfG1w-1 Received: by linux.microsoft.com (Postfix, from userid 1052) id BC25920ABD8B; Wed, 28 Jun 2023 14:09:48 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com BC25920ABD8B From: Fan Wu To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Date: Wed, 28 Jun 2023 14:09:27 -0700 Message-Id: <1687986571-16823-14-git-send-email-wufan@linux.microsoft.com> In-Reply-To: <1687986571-16823-1-git-send-email-wufan@linux.microsoft.com> References: <1687986571-16823-1-git-send-email-wufan@linux.microsoft.com> X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 3.1 on 10.11.54.3 Subject: [dm-devel] [RFC PATCH v10 13/17] fsverity: consume builtin signature via LSM hook X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: dm-devel@redhat.com, linux-doc@vger.kernel.org, Deven Bowers , roberto.sassu@huawei.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, audit@vger.kernel.org, linux-fscrypt@vger.kernel.org, Fan Wu , linux-integrity@vger.kernel.org MIME-Version: 1.0 Errors-To: dm-devel-bounces@redhat.com Sender: "dm-devel" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: linux.microsoft.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit fsverity represents a mechanism to support both integrity and authenticity protection of a file, supporting both signed and unsigned digests. An LSM which controls access to a resource based on authenticity and integrity of said resource, can then use this data to make an informed decision on the authorization (provided by the LSM's policy) of said claim. This effectively allows the extension of a policy enforcement layer in LSM for fsverity, allowing for more granular control of how a particular authenticity claim can be used. For example, "all (built-in) signed fsverity files should be allowed to execute, but only these hashes are allowed to be loaded as kernel modules". This enforcement must be done in kernel space, as a userspace only solution would fail a simple litmus test: Download a self-contained malicious binary that never touches the userspace stack. This binary would still be able to execute. Signed-off-by: Deven Bowers Signed-off-by: Fan Wu --- v1-v6: + Not present v7: Introduced v8: + Split fs/verity/ changes and security/ changes into separate patches + Change signature of fsverity_create_info to accept non-const inode + Change signature of fsverity_verify_signature to accept non-const inode + Don't cast-away const from inode. + Digest functionality dropped in favor of: ("fs-verity: define a function to return the integrity protected file digest") + Reworded commit description and title to match changes. + Fix a bug wherein no LSM implements the particular fsverity @name (or LSM is disabled), and returns -EOPNOTSUPP, causing errors. v9: + No changes v10: + Rename the signature blob key + Cleanup redundant code + Make the hook call depends on CONFIG_FS_VERITY_BUILTIN_SIGNATURES --- fs/verity/fsverity_private.h | 2 +- fs/verity/open.c | 26 +++++++++++++++++++++++++- include/linux/fsverity.h | 2 ++ 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h index 49bf3a1eb2a0..1f06dd6b1c6e 100644 --- a/fs/verity/fsverity_private.h +++ b/fs/verity/fsverity_private.h @@ -108,7 +108,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, unsigned int log_blocksize, const u8 *salt, size_t salt_size); -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc); void fsverity_set_info(struct inode *inode, struct fsverity_info *vi); diff --git a/fs/verity/open.c b/fs/verity/open.c index 1db5106a9c38..91f632df08b8 100644 --- a/fs/verity/open.c +++ b/fs/verity/open.c @@ -8,6 +8,7 @@ #include "fsverity_private.h" #include +#include #include static struct kmem_cache *fsverity_info_cachep; @@ -172,12 +173,28 @@ static int compute_file_digest(const struct fsverity_hash_alg *hash_alg, return err; } +#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES +static int fsverity_inode_setsecurity(struct inode *inode, + struct fsverity_descriptor *desc) +{ + return security_inode_setsecurity(inode, FS_VERITY_INODE_SEC_NAME, + desc->signature, + le32_to_cpu(desc->sig_size), 0); +} +#else +static inline int fsverity_inode_setsecurity(struct inode *inode, + struct fsverity_descriptor *desc) +{ + return 0; +} +#endif /* CONFIG_IPE_PROP_FS_VERITY*/ + /* * Create a new fsverity_info from the given fsverity_descriptor (with optional * appended builtin signature), and check the signature if present. The * fsverity_descriptor must have already undergone basic validation. */ -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc) { struct fsverity_info *vi; @@ -242,6 +259,13 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode, spin_lock_init(&vi->hash_page_init_lock); } + err = fsverity_inode_setsecurity(inode, desc); + if (err == -EOPNOTSUPP) + err = 0; + + if (err) + goto fail; + return vi; fail: diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h index 1eb7eae580be..9666721baf15 100644 --- a/include/linux/fsverity.h +++ b/include/linux/fsverity.h @@ -319,4 +319,6 @@ static inline int fsverity_prepare_setattr(struct dentry *dentry, return 0; } +#define FS_VERITY_INODE_SEC_NAME "fsverity.builtin-sig" + #endif /* _LINUX_FSVERITY_H */ -- 2.25.1 -- dm-devel mailing list dm-devel@redhat.com https://listman.redhat.com/mailman/listinfo/dm-devel