From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4275AC2D0E5 for ; Mon, 30 Mar 2020 16:45:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1873B2073B for ; Mon, 30 Mar 2020 16:45:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727148AbgC3Qpt convert rfc822-to-8bit (ORCPT ); Mon, 30 Mar 2020 12:45:49 -0400 Received: from lhrrgout.huawei.com ([185.176.76.210]:2620 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729372AbgC3Qps (ORCPT ); Mon, 30 Mar 2020 12:45:48 -0400 Received: from lhreml730-chm.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id A42FDB5919EEB1BC07AA; Mon, 30 Mar 2020 17:45:46 +0100 (IST) Received: from fraeml701-chm.china.huawei.com (10.206.15.50) by lhreml730-chm.china.huawei.com (10.201.108.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.1713.5; Mon, 30 Mar 2020 17:45:46 +0100 Received: from fraeml714-chm.china.huawei.com (10.206.15.33) by fraeml701-chm.china.huawei.com (10.206.15.50) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1913.5; Mon, 30 Mar 2020 18:45:45 +0200 Received: from fraeml714-chm.china.huawei.com ([10.206.15.33]) by fraeml714-chm.china.huawei.com ([10.206.15.33]) with mapi id 15.01.1913.007; Mon, 30 Mar 2020 18:45:45 +0200 From: Roberto Sassu To: Lev Olshvang , "linux-integrity@vger.kernel.org" , Mimi Zohar CC: Silviu Vlasceanu Subject: RE: [PATCH] integrity ima_policy : Select files by suffix Thread-Topic: [PATCH] integrity ima_policy : Select files by suffix Thread-Index: AQHWBo65vCeWAgZAckG7CKI3oVYVLahhUH0w Date: Mon, 30 Mar 2020 16:45:45 +0000 Message-ID: <1244b6bcc384413581da33c9b92743b8@huawei.com> References: <20200330122434.GB28214@kl> In-Reply-To: <20200330122434.GB28214@kl> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.47.5.91] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 X-CFilter-Loop: Reflected Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org > -----Original Message----- > From: linux-integrity-owner@vger.kernel.org [mailto:linux-integrity- > owner@vger.kernel.org] On Behalf Of Lev Olshvang > Sent: Monday, March 30, 2020 2:28 PM > To: linux-integrity@vger.kernel.org; Mimi Zohar > Subject: [PATCH] integrity ima_policy : Select files by suffix > > From: Lev Olshvang > Date: Fri, 27 Mar 2020 20:50:01 +0300 > Reply-To: > Subject: [PATCH] integrity ima_policy : Select files by suffix > > IMA policy rule allows to select files based on uid, gid, fsuid. etc. > One tremendously useful selector(IMHO) is the file suffix. > > I think of systemd service files, configurution files, etc. > > But the real goal of the patch is the ability to validate shell scripts. > Shell provides too many different ways to run the script: > input redirrection, pipe, command line parameters. Given that file name is not protected, I would suggest to look instead at the execution permission of the file. This information is protected by EVM. In a second time, we could consider to enforce the policy in the interpreters that every script must be executable, as suggested here: https://lkml.org/lkml/2019/4/15/825 Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli