From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-integrity-owner@vger.kernel.org>
Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:35268 "EHLO
        mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL)
        by vger.kernel.org with ESMTP id S1756238AbeAHMSd (ORCPT
        <rfc822;linux-integrity@vger.kernel.org>);
        Mon, 8 Jan 2018 07:18:33 -0500
Received: from pps.filterd (m0098419.ppops.net [127.0.0.1])
        by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.21) with SMTP id w08CE0iM091652
        for <linux-integrity@vger.kernel.org>; Mon, 8 Jan 2018 07:18:33 -0500
Received: from e06smtp14.uk.ibm.com (e06smtp14.uk.ibm.com [195.75.94.110])
        by mx0b-001b2d01.pphosted.com with ESMTP id 2fc85k18yq-1
        (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT)
        for <linux-integrity@vger.kernel.org>; Mon, 08 Jan 2018 07:18:32 -0500
Received: from localhost
        by e06smtp14.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted
        for <linux-integrity@vger.kernel.org> from <zohar@linux.vnet.ibm.com>;
        Mon, 8 Jan 2018 12:18:31 -0000
Subject: Re: [PATCH V5 2/2] IMA: Support using new creds in appraisal policy
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: Matthew Garrett <mjg59@google.com>, linux-integrity@vger.kernel.org
Cc: Paul Moore <paul@paul-moore.com>,
        Stephen Smalley <sds@tycho.nsa.gov>,
        Eric Paris <eparis@parisplace.org>, selinux@tycho.nsa.gov,
        Casey Schaufler <casey@schaufler-ca.com>,
        linux-security-module@vger.kernel.org,
        Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Date: Mon, 08 Jan 2018 07:18:25 -0500
In-Reply-To: <20180105211536.11611-2-mjg59@google.com>
References: <20180105211536.11611-1-mjg59@google.com>
         <20180105211536.11611-2-mjg59@google.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Message-Id: <1515413905.3460.40.camel@linux.vnet.ibm.com>
Sender: linux-integrity-owner@vger.kernel.org
List-ID: <linux-integrity.vger.kernel.org>

On Fri, 2018-01-05 at 13:15 -0800, Matthew Garrett wrote:
> The existing BPRM_CHECK functionality in IMA validates against the
> credentials of the existing process, not any new credentials that the
> child process may transition to. Add an additional CREDS_CHECK target
> and refactor IMA to pass the appropriate creds structure. In
> ima_bprm_check(), check with both the existing process credentials and
> the credentials that will be committed when the new process is started.
> This will not change behaviour unless the system policy is extended to
> include CREDS_CHECK targets - BPRM_CHECK will continue to check the same
> credentials that it did previously.

Refactoring IMA to pass the creds structure all the way down is a
generic solution, but if the CREDS_CHECK rule is only being called
from ima_bprm_check(), "container_of" the bprm->file returns a pointer
to the bprm structure.  Perhaps you could limit the amount of
refactoring needed based on the func.

I would prefer new arguments be added to process_measurement() only as
a last resort.

Could you include in the patch description a simple method for testing
this change?

thanks,

Mimi