Re: [PATCH 08/13] ipe: handle errors from resolving the real inode

[bot+bpf-ci@kernel.org]

[-- Attachment #1: Type: text/plain, Size: 2833 bytes --]

> ipe: handle errors from resolving the real inode

TL;DR: Behaviour question: the new ipe_evaluate_event() early return for an
unresolvable real inode skips ipe_audit_match(), so enforce-mode -EACCES and
permissive-mode allows may leave no IPE audit record. Should it audit?

> diff --git a/security/ipe/eval.c b/security/ipe/eval.c
> --- a/security/ipe/eval.c
> +++ b/security/ipe/eval.c

[ ... ]

> @@ -335,6 +339,15 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
>  		return 0;
>  	}
>  
> +	/*
> +	 * Without the inode hosting the data none of the properties of the
> +	 * file can be evaluated. Refuse it unless IPE is permissive.
> +	 */
> +	if (ctx->file_err) {
> +		rcu_read_unlock();
> +		return READ_ONCE(enforce) ? -EACCES : 0;
> +	}
> +

Should this path emit an AUDIT_IPE_ACCESS record?

This early return skips the eval: label, so ipe_audit_match() is never
called.  Every other way ipe_evaluate_event() ends in a denial goes through:

eval:
	ipe_audit_match(ctx, match_type, action, rule);
	rcu_read_unlock();

	if (action == IPE_ACTION_DENY)
		rc = -EACCES;

	if (!READ_ONCE(enforce))
		rc = 0;

With this patch, in permissive mode a file whose data cannot be resolved
returns 0 and leaves no record at all, even though
Documentation/admin-guide/LSM/ipe.rst says that in permissive mode policy
violations are logged.  In enforce mode the -EACCES has no IPE audit record
to explain it.  The commit message says "Permissive mode allows it like any
other denial", but other denials are audited and this one is not.

This path can be reached for an already open file.  ovl_open() verifies
lowerdata and sets OVL_VERIFIED_DIGEST, but a metacopy copy-up clears that
flag (ovl_clear_flag(OVL_VERIFIED_DIGEST, inode) in fs/overlayfs/copy_up.c).
A later mmap(PROT_EXEC) on the open fd then goes:

vm_mmap_pgoff()
  security_mmap_file()
    ipe_mmap_file()
      ipe_build_eval_ctx()
        d_real_data_inode()
          ovl_d_real()
            ovl_verify_lowerdata()
              ovl_maybe_validate_verity()

which can fail with -EINTR from ovl_inode_lock_interruptible() or with an
error from ovl_validate_verity(), setting ctx->file_err.  The IMA patch in
this series (c9952f8fed84) describes the same scenario, and its error path
in ima_collect_measurement() still calls integrity_audit_msg().

Could this set action = IPE_ACTION_DENY with a suitable match type and jump
to eval:, or use a dedicated audit helper that records the error, so that
denials and permissive-mode would-be denials are still logged?  No later
commit in the series touches security/ipe.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/43723438893