From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-bc0d.mail.infomaniak.ch (smtp-bc0d.mail.infomaniak.ch [45.157.188.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DD291E2312 for ; Tue, 3 Dec 2024 11:53:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.157.188.13 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733226791; cv=none; b=CdHJ+ZYrqX7PbLbh9NUCzauwr88Cb12Ak4pNFOKdsD7ypy5O9UBa+WgRRKsEzrVpBjrrVmSj/GFvmffstXM+O8F7tvcJq5xCvsDNfw1dfLOk2u/JuKZphLuHsFfKi+ze4pt2wquwoeINoQ8CoaFdxzgrj18ZLFYHgsZa2nsM6MA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733226791; c=relaxed/simple; bh=CMt8X3Hmt3yabztimpR+ulUyfvruG2LG3+5FXadS/Z0=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=b1GFgvmUJ94Bld6rdjQbxPjprfwHe8fDJPe+7e2iwxPmoiaghBgWRL9ZneqSGvRx64VYK+cBIZt7q+vXihLIyG34mj/pZ5DVG7VN4mGj2vVzrhRbdjanGr8bj4NrVBLPbPAGNo3wLON79CT/itwBoKH9s8obVZaBANQHxlv655E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=bjOmS4An; arc=none smtp.client-ip=45.157.188.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="bjOmS4An" Received: from smtp-4-0000.mail.infomaniak.ch (smtp-4-0000.mail.infomaniak.ch [10.7.10.107]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4Y2fD93VWyzrZN; Tue, 3 Dec 2024 12:52:57 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1733226777; bh=EzSBlNqBL6lCmaIIrqhLDGVc/DV5ofgikjZdLcgCDkU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=bjOmS4An+lERmyGsmnrp6Ic7/QHZi2uZqUaZx76we35hFEpeZ36lpbrmoB1eQmZ8L PunjS8DnYDwwv5YZ4WgMjdkZ691reDfaXx4wYA+hq2CI/MgiTgJaTvNtly8v9tUcmw isisnU3hfOELkb0bcsnBanHjaPAaw6WGXzx8esE4= Received: from unknown by smtp-4-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4Y2fD84YXHzlLD; Tue, 3 Dec 2024 12:52:56 +0100 (CET) Date: Tue, 3 Dec 2024 12:52:54 +0100 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Mimi Zohar Cc: linux-integrity@vger.kernel.org, roberto.sassu@huawei.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Jeff Xu , Kees Cook , Paul Moore , audit@vger.kernel.org Subject: Re: [RFC PATCH] ima: instantiate the bprm_creds_for_exec() hook Message-ID: <20241203.evei6IeKai4E@digikod.net> References: <20241127150526.97348-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20241127150526.97348-1-zohar@linux.ibm.com> X-Infomaniak-Routing: alpha CCing Jeff, Kees, Paul, and audit@ I guess this RFC is superseded by https://lore.kernel.org/r/20241127210234.121546-1-zohar@linux.ibm.com (and then doesn't need a reply) but for reference, here was may main concern anyway. On Wed, Nov 27, 2024 at 10:05:26AM -0500, Mimi Zohar wrote: > Like direct file execution (e.g. ./script.sh), indirect file exection > (e.g. sh script.sh) need to be measured and appraised. Instantiate > the new security_bprm_creds_for_exec() hook to measure and verify the > indirect file's integrity. Unlike direct file execution, indirect file > execution is optionally enforced by the interpreter. > > Define two new audit messages: > - Userspace-enforcing-IMA-signature-required > - Userspace-not-enforcing-IMA-signature-required > > Signed-off-by: Roberto Sassu > Signed-off-by: Mimi Zohar > --- > security/integrity/ima/ima_appraise.c | 24 +++++++++++++++++++++++- > security/integrity/ima/ima_main.c | 22 ++++++++++++++++++++++ > 2 files changed, 45 insertions(+), 1 deletion(-) > > diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c > index 656c709b974f..5a3b5cdecb51 100644 > --- a/security/integrity/ima/ima_appraise.c > +++ b/security/integrity/ima/ima_appraise.c > @@ -8,6 +8,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -16,6 +17,7 @@ > #include > #include > #include > +#include > > #include "ima.h" > > @@ -469,6 +471,26 @@ int ima_check_blacklist(struct ima_iint_cache *iint, > return rc; > } > > +static int is_bprm_creds_for_exec(enum ima_hooks func, struct file *file, > + const char **cause) > +{ > + const struct cred *cred = current_cred(); > + struct linux_binprm *bprm = NULL; > + > + if (func == BPRM_CHECK) { > + bprm = container_of(&file, struct linux_binprm, file); > + if (!bprm->is_check) > + return 0; > + > + if (cred->securebits & SECBIT_EXEC_RESTRICT_FILE) The is_bprm_creds_for_exec() implementation from the next patch series doesn't check securebits anymore, but for reference, LSMs should not rely on caller's securebits to infer a behavior because user space could just not check these bits. For instance, on tailored systems such as chromeOS, the libc could call execveat+AT_EXECVE_CHECK whatever SECBIT_EXEC_RESTRICT_FILE is set or not: https://lore.kernel.org/r/20241127.aizae7eeHohn@digikod.net > + *cause = "Userspace-enforcing-IMA-signature-required"; > + else > + *cause = "Userspace-not-enforcing-IMA-signature-required"; > + return 1; > + } > + return 0; > +} > + > /* > * ima_appraise_measurement - appraise file measurement > * > @@ -502,7 +524,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint, > if (iint->flags & IMA_DIGSIG_REQUIRED) { > if (iint->flags & IMA_VERITY_REQUIRED) > cause = "verity-signature-required"; > - else > + else if (!is_bprm_creds_for_exec(func, file, &cause)) > cause = "IMA-signature-required"; > } else { > cause = "missing-hash"; > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > index 06132cf47016..2b5d6bae77a4 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -554,6 +554,27 @@ static int ima_bprm_check(struct linux_binprm *bprm) > MAY_EXEC, CREDS_CHECK); > } > > +/** > + * ima_bprm_creds_for_exec - based on policy, collect/store/appraise measurement. > + * @bprm: contains the linux_binprm structure > + * > + * Based on the IMA policy and the execvat(2) AT_CHECK flag, measure and > + * appraise the integrity of a file to be executed by script interpreters. > + * Unlike any of the other LSM hooks where the kernel enforces file integrity, > + * enforcing file integrity is left up to the discretion of the script > + * interpreter (userspace). > + * > + * On success return 0. On integrity appraisal error, assuming the file > + * is in policy and IMA-appraisal is in enforcing mode, return -EACCES. > + */ > +static int ima_bprm_creds_for_exec(struct linux_binprm *bprm) > +{ > + if (!bprm->is_check) > + return 0; > + > + return ima_bprm_check(bprm); > +} > + > /** > * ima_file_check - based on policy, collect/store measurement. > * @file: pointer to the file to be measured > @@ -1177,6 +1198,7 @@ static int __init init_ima(void) > > static struct security_hook_list ima_hooks[] __ro_after_init = { > LSM_HOOK_INIT(bprm_check_security, ima_bprm_check), > + LSM_HOOK_INIT(bprm_creds_for_exec, ima_bprm_creds_for_exec), > LSM_HOOK_INIT(file_post_open, ima_file_check), > LSM_HOOK_INIT(inode_post_create_tmpfile, ima_post_create_tmpfile), > LSM_HOOK_INIT(file_release, ima_file_free), > -- > 2.47.0 > >