From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751910AbdJYPFw (ORCPT ); Wed, 25 Oct 2017 11:05:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49547 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750823AbdJYPFr (ORCPT ); Wed, 25 Oct 2017 11:05:47 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com A6479C070E2A Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=brdeoliv@redhat.com Date: Wed, 25 Oct 2017 13:05:44 -0200 From: "Bruno E. O. Meneguele" To: Mimi Zohar Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, serge@hallyn.com, james.l.morris@oracle.com, dmitry.kasatkin@gmail.com, rusty@rustcorp.com.au, jeyu@kernel.org Subject: Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG Message-ID: <20171025150544.GC26762@glitch> References: <1508885697.3164.5.camel@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="RYJh/3oyKhIjGcML" Content-Disposition: inline In-Reply-To: <1508885697.3164.5.camel@linux.vnet.ibm.com> X-PGP-Key: http://keys.gnupg.net/pks/lookup?op=get&search=0x3823031E4660608D User-Agent: Mutt/1.9.1 (2017-09-22) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Wed, 25 Oct 2017 15:05:47 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --RYJh/3oyKhIjGcML Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 24-10, Mimi Zohar wrote: > On Tue, 2017-10-24 at 15:37 -0200, Bruno E. O. Meneguele wrote: > > When the user requests MODULE_CHECK policy and its kernel is compiled > > with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just > > those loaded in initram time. One option the user would have would be > > set a kernel cmdline param (module.sig_enforce) to true, but the IMA > > module check code doesn't rely on this value, it checks just > > CONFIG_MODULE_SIG_FORCE. > >=20 > > This patch solves this problem checking for the exported value of > > module.sig_enforce cmdline param intead of CONFIG_MODULE_SIG_FORCE, > > which holds the effective value (CONFIG || param). > >=20 > > Signed-off-by: Bruno E. O. Meneguele > > --- > > security/integrity/ima/ima_main.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > >=20 > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima= /ima_main.c > > index e4ab8ef8016e..d11a7fcc5c8b 100644 > > --- a/security/integrity/ima/ima_main.c > > +++ b/security/integrity/ima/ima_main.c > > @@ -356,12 +356,12 @@ void ima_post_path_mknod(struct dentry *dentry) > > */ > > int ima_read_file(struct file *file, enum kernel_read_file_id read_id) > > { > > + bool sig_enforce =3D is_module_sig_enforced(); > > + > > if (!file && read_id =3D=3D READING_MODULE) { >=20 > The only reason for getting here is that you're using the old module > load syscall. =A0Is there a reason for not using the new one, which > passes the file descriptor? >=20 > thanks, >=20 > Mimi >=20 Basicaly because the way kmod handles compressed (gz/xz) modules. The way it's today would require major changes in the code or some kind of memfd_create() + xattrs reassignement in order to finit_module() be used correctly. Considering it would take some time to be accepted or even to figure out the correct way to tackle it, the current IMA module check code works aside kernel module signature validation, which is fine for now for me, but has the problem that this patch tries to solve in the CONFIG_MODULE_SIG_FORCE check (ignoring module.sig_enforce cmdline param). > > -#ifndef CONFIG_MODULE_SIG_FORCE > > - if ((ima_appraise & IMA_APPRAISE_MODULES) && > > + if (!sig_enforce && (ima_appraise & IMA_APPRAISE_MODULES) && > > (ima_appraise & IMA_APPRAISE_ENFORCE)) > > return -EACCES; /* INTEGRITY_UNKNOWN */ > > -#endif > > return 0; /* We rely on module signature checking */ > > } > > return 0; >=20 >=20 --=20 bmeneg=20 PGP Key: http://bmeneg.com/pubkey.txt --RYJh/3oyKhIjGcML Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEdWo6nTbnZdbDmXutYdRkFR+RokMFAlnwqEUACgkQYdRkFR+R okM5PwgA1+QXJF0mOVkq1wIzl/EeXBXgXW74tcWQ4uDhmpfJz39/thKkfUiuKb0y gKVGa2dTr1N56v8kx5civ6COgo42GCr3zoZZXaR/ELmvKfFiRjHX9bY4fdxiMECe /Nby/Z4mXq/SeQdRMPMPM+huV76CNR/H5vej3AQLqJp3RFVWvOgH7mD87imOGZFj slt57LbK5UsMsnWob1WUcvDIJyumJCeHhvwpXSjvU3waLjaSFxfsbM9xXpG3ZbP8 U97HAoWj+uXse+IPZZBUnCE4sGunWMrWXudICMLv1gPqlHDbDbqpLM775ZpV0zVf rKfh7wUlJj+hw5B425x4VI7+ICCqow== =vtb8 -----END PGP SIGNATURE----- --RYJh/3oyKhIjGcML--