Roberto Sassu
2022-Nov-23 09:51 UTC
[Ocfs2-devel] [PATCH v5 0/6] evm: Prepare for moving to the LSM infrastructure
From: Roberto Sassu <roberto.sassu at huawei.com> One of the challenges that must be tackled to move IMA and EVM to the LSM infrastructure is to ensure that EVM is capable to correctly handle multiple stacked LSMs providing an xattr at file creation. At the moment, there are few issues that would prevent a correct integration. This patch set aims at solving them.>From the LSM infrastructure side, the LSM stacking feature added thepossibility of registering multiple implementations of the security hooks, that are called sequentially whenever someone calls the corresponding security hook. However, security_inode_init_security() is currently limited to support one xattr provided by LSM and one by EVM. It is ready to support multiple xattrs, as it can call the initxattrs() callback provided by filesystems. security_old_inode_init_security() can only support one xattr due to its API. In addition, using the call_int_hook() macro causes some issues. According to the documentation in include/linux/lsm_hooks.h, it is a legitimate case that an LSM returns -EOPNOTSUPP when it does not want to provide an xattr. However, the loop defined in the macro would stop calling subsequent LSMs if that happens. In the case of security_old_inode_init_security(), using the macro would also cause a memory leak due to replacing the *value pointer, if multiple LSMs provide an xattr.>From EVM side, the first operation to be done is to change the definitionof evm_inode_init_security() to be compatible with the security hook definition. Unfortunately, the current definition does not provide enough information for EVM, as it must have visibility of all xattrs provided by LSMs to correctly calculate the HMAC. This patch set changes the security hook definition by replacing the name, value and len triple with the xattr array allocated by security_inode_init_security(). Secondly, given that the place where EVM can fill an xattr is not provided anymore with the changed definition, EVM must know how many elements are in the xattr array. EVM can rely on the fact that the xattr array must be terminated with an element with name field set to NULL. If EVM is moved to the LSM infrastructure, the infrastructure will provide additional information. Casey suggested to use the reservation mechanism currently implemented for other security blobs, for xattrs. In this way, security_inode_init_security() can know after LSM initialization how many slots for xattrs should be allocated, and LSMs know the offset in the array from where they can start writing xattrs. One of the problem was that LSMs can decide at run-time, although they reserved a slot, to not use it (for example because they were not initialized). Given that the initxattrs() method implemented by filesystems expect that the array elements are contiguous, they would miss the slots after the one not being initialized. security_check_compact_filled_xattrs() has been introduced to overcome this problem and also to check the correctness of the xattrs provided by the LSMs. Filesystems calling security_inode_init_security() are already able to set multiple xattrs. Those which were using security_old_inode_init_security(), ocfs2 and reiserfs, were converted to using security_inode_init_security() and security_old_inode_init_security() was removed. However, they are still limited to setting only one xattr despite more are available, as their code is not ready to set multiple xattrs at inode creation time. Support for it can be added by those filesystems later. This patch set has been tested by introducing several instances of a TestLSM (some providing an xattr, some not, one with a wrong implementation to see how the LSM infrastructure handles it, one providing multiple xattrs and another providing an xattr but in a disabled state). The patch is not included in this set but it is available here: https://github.com/robertosassu/linux/commit/e13a03236df0c399dccb73df5fe4cfceb4bb1d89 The test, added to ima-evm-utils, is available here: https://github.com/robertosassu/ima-evm-utils/blob/evm-multiple-lsms-v5-devel-v3/tests/evm_multiple_lsms.test The test takes a UML kernel built by Github Actions and launches it several times, each time with a different combination of LSMs and filesystems (ext4, reiserfs, ocfs2). After boot, it first checks that there is an xattr for each LSM providing it (for reiserfs and ocfs2 just the first LSM), and then (for ext4) calculates the HMAC in user space and compares it with the HMAC calculated by EVM in kernel space. A test report can be obtained here: https://github.com/robertosassu/ima-evm-utils/actions/runs/3525619568/jobs/5912560168 The patch set has been tested with both the SElinux and Smack test suites. Below, there is the summary of the test results: SELinux Test Suite result (without patches): Files=73, Tests=1346, 225 wallclock secs ( 0.43 usr 0.23 sys + 6.11 cusr 58.70 csys = 65.47 CPU) Result: FAIL Failed 4/73 test programs. 13/1346 subtests failed. SELinux Test Suite result (with patches): Files=73, Tests=1346, 225 wallclock secs ( 0.44 usr 0.22 sys + 6.15 cusr 59.94 csys = 66.75 CPU) Result: FAIL Failed 4/73 test programs. 13/1346 subtests failed. Smack Test Suite result (without patches): 95 Passed, 0 Failed, 100% Success rate Smack Test Suite result (with patches): 95 Passed, 0 Failed, 100% Success rate The patch set has also been successfully tested with a WIP branch where IMA/EVM have been moved to the LSM infrastructure. It is available here: https://github.com/robertosassu/linux/commits/ima-evm-lsms-v1-devel-v9-test This is the patch that moves EVM to the LSM infrastructure: https://github.com/robertosassu/linux/commit/a1e0682ef75cc8087327e6f446f586c02dd87c60 The only trivial changes, after this patch set, would be to allocate one element less in the xattr array (because EVM will reserve its own xattr), and to simply remove the call to evm_inode_init_security(). The test report when IMA and EVM are moved to the LSM infrastructure is available here: https://github.com/robertosassu/ima-evm-utils/actions/runs/3525750217/jobs/5912853636 Changelog v4: - Remove patch to call reiserfs_security_free(), already queued - Switch ocfs2 and reiserfs to security_inode_init_security() (suggested by Mimi) - Remove security_old_inode_init_security() (suggested by Paul) - Rename security_check_compact_xattrs() to security_check_compact_filled_xattrs() and add function description (suggested by Mimi) - Rename checked_xattrs parameter of security_check_compact_filled_xattrs() to num_filled_xattrs (suggested by Mimi) - Rename cur_xattrs variable in security_inode_init_security() to num_filled_xattrs (suggested by Mimi) v3: - Don't free the xattr name in reiserfs_security_free() - Don't include fs_data parameter in inode_init_security hook - Don't change evm_inode_init_security(), as it will be removed if EVM is stacked - Fix inode_init_security hook documentation - Drop lsm_find_xattr_slot(), use simple xattr reservation mechanism and introduce security_check_compact_xattrs() to compact the xattr array - Don't allocate xattr array if LSMs didn't reserve any xattr - Return zero if initxattrs() is not provided to security_inode_init_security(), -EOPNOTSUPP if value is not provided to security_old_inode_init_security() - Request LSMs to fill xattrs if only value (not the triple) is provided to security_old_inode_init_security(), to avoid unnecessary memory allocation v2: - rewrite selinux_old_inode_init_security() to use security_inode_init_security() - add lbs_xattr field to lsm_blob_sizes structure, to give the ability to LSMs to reserve slots in the xattr array (suggested by Casey) - add new parameter base_slot to inode_init_security hook definition v1: - add calls to reiserfs_security_free() and initialize sec->value to NULL (suggested by Tetsuo and Mimi) - change definition of inode_init_security hook, replace the name, value and len triple with the xattr array (suggested by Casey) - introduce lsm_find_xattr_slot() helper for LSMs to find an unused slot in the passed xattr array Roberto Sassu (6): reiserfs: Switch to security_inode_init_security() ocfs2: Switch to security_inode_init_security() security: Remove security_old_inode_init_security() security: Allow all LSMs to provide xattrs for inode_init_security hook evm: Align evm_inode_init_security() definition with LSM infrastructure evm: Support multiple LSMs providing an xattr fs/ocfs2/namei.c | 18 ++--- fs/ocfs2/xattr.c | 30 +++++++- fs/reiserfs/xattr_security.c | 23 ++++-- include/linux/evm.h | 12 +-- include/linux/lsm_hook_defs.h | 3 +- include/linux/lsm_hooks.h | 17 ++-- include/linux/security.h | 12 --- security/integrity/evm/evm.h | 2 + security/integrity/evm/evm_crypto.c | 9 ++- security/integrity/evm/evm_main.c | 28 +++++-- security/security.c | 115 +++++++++++++++++++++------- security/selinux/hooks.c | 19 +++-- security/smack/smack_lsm.c | 26 ++++--- 13 files changed, 213 insertions(+), 101 deletions(-) -- 2.25.1
Roberto Sassu
2022-Nov-23 09:51 UTC
[Ocfs2-devel] [PATCH v5 1/6] reiserfs: Switch to security_inode_init_security()
From: Roberto Sassu <roberto.sassu at huawei.com>
In preparation for removing security_old_inode_init_security(), switch to
security_inode_init_security().
Define the initxattrs callback reiserfs_initxattrs(), to populate the
name/value/len triple in the reiserfs_security_handle() with the first
xattr provided by LSMs. Multiple xattrs are currently not supported, as the
reiserfs_security_handle structure is exported to user space.
In reiserfs_initxattrs(), make a copy of the first xattr value, as
security_inode_init_security() frees it.
After the call to security_inode_init_security(), remove the check for
returning -EOPNOTSUPP, as security_inode_init_security() changes it to
zero.
Signed-off-by: Roberto Sassu <roberto.sassu at huawei.com>
---
fs/reiserfs/xattr_security.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
index 857a65b05726..0ba96757681d 100644
--- a/fs/reiserfs/xattr_security.c
+++ b/fs/reiserfs/xattr_security.c
@@ -39,6 +39,22 @@ static bool security_list(struct dentry *dentry)
return !IS_PRIVATE(d_inode(dentry));
}
+static int
+reiserfs_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+ void *fs_info)
+{
+ struct reiserfs_security_handle *sec = fs_info;
+
+ sec->value = kmemdup(xattr_array->value, xattr_array->value_len,
+ GFP_KERNEL);
+ if (!sec->value)
+ return -ENOMEM;
+
+ sec->name = xattr_array->name;
+ sec->length = xattr_array->value_len;
+ return 0;
+}
+
/* Initializes the security context for a new inode and returns the number
* of blocks needed for the transaction. If successful, reiserfs_security
* must be released using reiserfs_security_free when the caller is done. */
@@ -56,12 +72,9 @@ int reiserfs_security_init(struct inode *dir, struct inode
*inode,
if (IS_PRIVATE(dir))
return 0;
- error = security_old_inode_init_security(inode, dir, qstr, &sec->name,
- &sec->value, &sec->length);
+ error = security_inode_init_security(inode, dir, qstr,
+ &reiserfs_initxattrs, sec);
if (error) {
- if (error == -EOPNOTSUPP)
- error = 0;
-
sec->name = NULL;
sec->value = NULL;
sec->length = 0;
--
2.25.1
Roberto Sassu
2022-Nov-23 09:51 UTC
[Ocfs2-devel] [PATCH v5 2/6] ocfs2: Switch to security_inode_init_security()
From: Roberto Sassu <roberto.sassu at huawei.com>
In preparation for removing security_old_inode_init_security(), switch to
security_inode_init_security().
Extend the existing ocfs2_initxattrs() to take the
ocfs2_security_xattr_info structure from fs_info, and populate the
name/value/len triple with the first xattr provided by LSMs. Supporting
multiple xattrs is not currently supported, as it requires non-trivial
changes that can be done at a later time.
As fs_info was not used before, ocfs2_initxattrs() can now handle the case
of replicating the behavior of security_old_inode_init_security(), i.e.
just obtaining the xattr, in addition to setting all xattrs provided by
LSMs.
Finally, modify the handling of the return value from
ocfs2_init_security_get(). As security_inode_init_security() does not
return -EOPNOTSUPP, remove this case and directly handle the error if the
return value is not zero.
However, the previous case of receiving -EOPNOTSUPP should be still
taken into account, as security_inode_init_security() could return zero
without setting xattrs and ocfs2 would consider it as if the xattr was set.
Instead, if security_inode_init_security() returned zero, look at the xattr
if it was set, and behave accordingly, i.e. set si->enable to zero to
notify to the functions following ocfs2_init_security_get() that the xattr
is not available (same as if security_old_inode_init_security() returned
-EOPNOTSUPP).
Signed-off-by: Roberto Sassu <roberto.sassu at huawei.com>
---
fs/ocfs2/namei.c | 18 ++++++------------
fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++----
2 files changed, 32 insertions(+), 16 deletions(-)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 05f32989bad6..55fba81cd2d1 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -242,6 +242,7 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
int want_meta = 0;
int xattr_credits = 0;
struct ocfs2_security_xattr_info si = {
+ .name = NULL,
.enable = 1,
};
int did_quota_inode = 0;
@@ -315,12 +316,8 @@ static int ocfs2_mknod(struct user_namespace *mnt_userns,
/* get security xattr */
status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
if (status) {
- if (status == -EOPNOTSUPP)
- si.enable = 0;
- else {
- mlog_errno(status);
- goto leave;
- }
+ mlog_errno(status);
+ goto leave;
}
/* calculate meta data/clusters for setting security and acl xattr */
@@ -1805,6 +1802,7 @@ static int ocfs2_symlink(struct user_namespace
*mnt_userns,
int want_clusters = 0;
int xattr_credits = 0;
struct ocfs2_security_xattr_info si = {
+ .name = NULL,
.enable = 1,
};
int did_quota = 0, did_quota_inode = 0;
@@ -1875,12 +1873,8 @@ static int ocfs2_symlink(struct user_namespace
*mnt_userns,
/* get security xattr */
status = ocfs2_init_security_get(inode, dir, &dentry->d_name, &si);
if (status) {
- if (status == -EOPNOTSUPP)
- si.enable = 0;
- else {
- mlog_errno(status);
- goto bail;
- }
+ mlog_errno(status);
+ goto bail;
}
/* calculate meta data/clusters for setting security xattr */
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 95d0611c5fc7..55699c573541 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -7259,9 +7259,21 @@ static int ocfs2_xattr_security_set(const struct
xattr_handler *handler,
static int ocfs2_initxattrs(struct inode *inode, const struct xattr
*xattr_array,
void *fs_info)
{
+ struct ocfs2_security_xattr_info *si = fs_info;
const struct xattr *xattr;
int err = 0;
+ if (si) {
+ si->value = kmemdup(xattr_array->value, xattr_array->value_len,
+ GFP_KERNEL);
+ if (!si->value)
+ return -ENOMEM;
+
+ si->name = xattr_array->name;
+ si->value_len = xattr_array->value_len;
+ return 0;
+ }
+
for (xattr = xattr_array; xattr->name != NULL; xattr++) {
err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
xattr->name, xattr->value,
@@ -7277,13 +7289,23 @@ int ocfs2_init_security_get(struct inode *inode,
const struct qstr *qstr,
struct ocfs2_security_xattr_info *si)
{
+ int ret;
+
/* check whether ocfs2 support feature xattr */
if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
return -EOPNOTSUPP;
- if (si)
- return security_old_inode_init_security(inode, dir, qstr,
- &si->name, &si->value,
- &si->value_len);
+ if (si) {
+ ret = security_inode_init_security(inode, dir, qstr,
+ &ocfs2_initxattrs, si);
+ /*
+ * security_inode_init_security() does not return -EOPNOTSUPP,
+ * we have to check the xattr ourselves.
+ */
+ if (!ret && !si->name)
+ si->enable = 0;
+
+ return ret;
+ }
return security_inode_init_security(inode, dir, qstr,
&ocfs2_initxattrs, NULL);
--
2.25.1
Roberto Sassu
2022-Nov-23 09:51 UTC
[Ocfs2-devel] [PATCH v5 3/6] security: Remove security_old_inode_init_security()
From: Roberto Sassu <roberto.sassu at huawei.com>
As the remaining two users reiserfs and ocfs2 switched to
security_inode_init_security(), security_old_inode_init_security() can be
now removed.
Out-of-tree kernel modules should switch to security_inode_init_security()
too.
Signed-off-by: Roberto Sassu <roberto.sassu at huawei.com>
---
include/linux/security.h | 12 ------------
security/security.c | 11 -----------
2 files changed, 23 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index ca1b7109c0db..c682fc96ed61 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -336,9 +336,6 @@ int security_inode_init_security(struct inode *inode, struct
inode *dir,
int security_inode_init_security_anon(struct inode *inode,
const struct qstr *name,
const struct inode *context_inode);
-int security_old_inode_init_security(struct inode *inode, struct inode *dir,
- const struct qstr *qstr, const char **name,
- void **value, size_t *len);
int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t
mode);
int security_inode_link(struct dentry *old_dentry, struct inode *dir,
struct dentry *new_dentry);
@@ -771,15 +768,6 @@ static inline int security_inode_init_security_anon(struct
inode *inode,
return 0;
}
-static inline int security_old_inode_init_security(struct inode *inode,
- struct inode *dir,
- const struct qstr *qstr,
- const char **name,
- void **value, size_t *len)
-{
- return -EOPNOTSUPP;
-}
-
static inline int security_inode_create(struct inode *dir,
struct dentry *dentry,
umode_t mode)
diff --git a/security/security.c b/security/security.c
index 79d82cb6e469..e2857446fd32 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1132,17 +1132,6 @@ int security_inode_init_security_anon(struct inode
*inode,
context_inode);
}
-int security_old_inode_init_security(struct inode *inode, struct inode *dir,
- const struct qstr *qstr, const char **name,
- void **value, size_t *len)
-{
- if (unlikely(IS_PRIVATE(inode)))
- return -EOPNOTSUPP;
- return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir,
- qstr, name, value, len);
-}
-EXPORT_SYMBOL(security_old_inode_init_security);
-
#ifdef CONFIG_SECURITY_PATH
int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t
mode,
unsigned int dev)
--
2.25.1
Roberto Sassu
2022-Nov-23 09:52 UTC
[Ocfs2-devel] [PATCH v5 4/6] security: Allow all LSMs to provide xattrs for inode_init_security hook
From: Roberto Sassu <roberto.sassu at huawei.com>
Currently, security_inode_init_security() supports only one LSM providing
an xattr and EVM calculating the HMAC on that xattr, plus other inode
metadata.
Allow all LSMs to provide one or multiple xattrs, by extending the security
blob reservation mechanism. Introduce the new lbs_xattr field of the
lsm_blob_sizes structure, so that each LSM can specify how many xattrs it
needs, and the LSM infrastructure knows how many xattr slots it should
allocate.
Dynamically allocate the xattrs array to be populated by LSMs with the
inode_init_security hook, and pass it to the latter instead of the
name/value/len triple. Update the documentation accordingly, and fix the
description of the xattr name, as it is not allocated anymore.
Since the LSM infrastructure, at initialization time, updates the number of
the requested xattrs provided by each LSM with a corresponding offset in
the security blob (in this case the xattr array), it makes straightforward
for an LSM to access the right position in the xattr array.
There is still the issue that an LSM might not fill the xattr, even if it
requests it (legitimate case, for example it might have been loaded but not
initialized with a policy). Since users of the xattr array (e.g. the
initxattrs() callbacks) detect the end of the xattr array by checking if
the xattr name is NULL, not filling an xattr would cause those users to
stop scanning xattrs prematurely.
Solve that issue by introducing security_check_compact_filled_xattrs(),
which does a basic check of the xattr array (if the xattr name is filled,
the xattr value should be too, and viceversa), and compacts the xattr array
by removing the holes.
An alternative solution would be to let users of the xattr array know the
number of elements of the xattr array, so that they don't have to check the
termination. However, this seems more invasive, compared to a simple move
of few array elements.
security_check_compact_filled_xattrs() also determines how many xattrs in
the xattr array have been filled. If there is none, skip
evm_inode_init_security() and initxattrs(). Skipping the former also avoids
EVM to crash the kernel, as it is expecting a filled xattr.
Finally, adapt both SELinux and Smack to use the new definition of the
inode_init_security hook, and to correctly fill the designated slots in the
xattr array. For Smack, reserve space for the other defined xattrs although
they are not set yet in smack_inode_init_security().
Signed-off-by: Roberto Sassu <roberto.sassu at huawei.com>
---
include/linux/lsm_hook_defs.h | 3 +-
include/linux/lsm_hooks.h | 17 ++++--
security/security.c | 103 +++++++++++++++++++++++++++++-----
security/selinux/hooks.c | 19 ++++---
security/smack/smack_lsm.c | 26 +++++----
5 files changed, 127 insertions(+), 41 deletions(-)
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index ec119da1d89b..be344d0211f8 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -112,8 +112,7 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64
mask,
LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)
LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)
LSM_HOOK(int, 0, inode_init_security, struct inode *inode,
- struct inode *dir, const struct qstr *qstr, const char **name,
- void **value, size_t *len)
+ struct inode *dir, const struct qstr *qstr, struct xattr *xattrs)
LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
const struct qstr *name, const struct inode *context_inode)
LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 4ec80b96c22e..ba1655370643 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -229,18 +229,22 @@
* This hook is called by the fs code as part of the inode creation
* transaction and provides for atomic labeling of the inode, unlike
* the post_create/mkdir/... hooks called by the VFS. The hook function
- * is expected to allocate the name and value via kmalloc, with the caller
- * being responsible for calling kfree after using them.
+ * is expected to allocate the value via kmalloc, with the caller
+ * being responsible for calling kfree after using it.
* If the security module does not use security attributes or does
* not wish to put a security attribute on this particular inode,
* then it should return -EOPNOTSUPP to skip this processing.
* @inode contains the inode structure of the newly created inode.
* @dir contains the inode structure of the parent directory.
* @qstr contains the last path component of the new object
- * @name will be set to the allocated name suffix (e.g. selinux).
- * @value will be set to the allocated attribute value.
- * @len will be set to the length of the value.
- * Returns 0 if @name and @value have been successfully set,
+ * @xattrs contains the full array of xattrs provided by LSMs where
+ * ->name will be set to the name suffix (e.g. selinux).
+ * ->value will be set to the allocated attribute value.
+ * ->value_len will be set to the length of the value.
+ * Slots in @xattrs need to be reserved by LSMs by providing the number of
+ * the desired xattrs in the lbs_xattr field of the lsm_blob_sizes
+ * structure.
+ * Returns 0 if the requested slots in @xattrs have been successfully set,
* -EOPNOTSUPP if no security attribute is needed, or
* -ENOMEM on memory allocation failure.
* @inode_init_security_anon:
@@ -1624,6 +1628,7 @@ struct lsm_blob_sizes {
int lbs_ipc;
int lbs_msg_msg;
int lbs_task;
+ int lbs_xattr;
};
/*
diff --git a/security/security.c b/security/security.c
index e2857446fd32..26aaa5850867 100644
--- a/security/security.c
+++ b/security/security.c
@@ -30,8 +30,6 @@
#include <linux/msg.h>
#include <net/flow.h>
-#define MAX_LSM_EVM_XATTR 2
-
/* How many LSMs were built into the kernel? */
#define LSM_COUNT (__end_lsm_info - __start_lsm_info)
@@ -210,6 +208,7 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes
*needed)
lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
lsm_set_blob_size(&needed->lbs_superblock,
&blob_sizes.lbs_superblock);
lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
+ lsm_set_blob_size(&needed->lbs_xattr, &blob_sizes.lbs_xattr);
}
/* Prepare LSM for initialization. */
@@ -346,6 +345,7 @@ static void __init ordered_lsm_init(void)
init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);
init_debug("superblock blob size = %d\n",
blob_sizes.lbs_superblock);
init_debug("task blob size = %d\n", blob_sizes.lbs_task);
+ init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr);
/*
* Create any kmem_caches needed for blobs
@@ -1089,37 +1089,110 @@ int security_dentry_create_files_as(struct dentry
*dentry, int mode,
}
EXPORT_SYMBOL(security_dentry_create_files_as);
+/**
+ * security_check_compact_filled_xattrs - check xattrs and make array
contiguous
+ * @xattrs: xattr array filled by LSMs
+ * @num_xattrs: length of xattr array
+ * @num_filled_xattrs: number of already processed xattrs
+ *
+ * Ensure that each xattr slot is correctly filled and close the gaps in the
+ * xattr array if an LSM didn't provide an xattr for which it asked space
+ * (legitimate case, it might have been loaded but not initialized). An LSM
+ * might request space in the xattr array for one or multiple xattrs. The LSM
+ * infrastructure ensures that all requests by LSMs are satisfied.
+ *
+ * Track the number of filled xattrs in @num_filled_xattrs, so that it is easy
+ * to determine whether the currently processed xattr is fine in its position
+ * (if all previous xattrs were filled) or it should be moved after the last
+ * filled xattr.
+ *
+ * Return: zero if all xattrs are valid, -EINVAL otherwise.
+ */
+static int security_check_compact_filled_xattrs(struct xattr *xattrs,
+ int num_xattrs,
+ int *num_filled_xattrs)
+{
+ int i;
+
+ for (i = *num_filled_xattrs; i < num_xattrs; i++) {
+ if ((!xattrs[i].name && xattrs[i].value) ||
+ (xattrs[i].name && !xattrs[i].value))
+ return -EINVAL;
+
+ if (!xattrs[i].name)
+ continue;
+
+ if (i == *num_filled_xattrs) {
+ (*num_filled_xattrs)++;
+ continue;
+ }
+
+ memcpy(xattrs + (*num_filled_xattrs)++, xattrs + i,
+ sizeof(*xattrs));
+ memset(xattrs + i, 0, sizeof(*xattrs));
+ }
+
+ return 0;
+}
+
int security_inode_init_security(struct inode *inode, struct inode *dir,
const struct qstr *qstr,
const initxattrs initxattrs, void *fs_data)
{
- struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
- struct xattr *lsm_xattr, *evm_xattr, *xattr;
- int ret;
+ struct security_hook_list *P;
+ struct xattr *new_xattrs;
+ struct xattr *xattr;
+ int ret = -EOPNOTSUPP, num_filled_xattrs = 0;
if (unlikely(IS_PRIVATE(inode)))
return 0;
+ if (!blob_sizes.lbs_xattr)
+ return 0;
+
if (!initxattrs)
return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
- dir, qstr, NULL, NULL, NULL);
- memset(new_xattrs, 0, sizeof(new_xattrs));
- lsm_xattr = new_xattrs;
- ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
- &lsm_xattr->name,
- &lsm_xattr->value,
- &lsm_xattr->value_len);
- if (ret)
+ dir, qstr, NULL);
+ /* Allocate +1 for EVM and +1 as terminator. */
+ new_xattrs = kcalloc(blob_sizes.lbs_xattr + 2, sizeof(*new_xattrs),
+ GFP_NOFS);
+ if (!new_xattrs)
+ return -ENOMEM;
+
+ hlist_for_each_entry(P, &security_hook_heads.inode_init_security,
+ list) {
+ ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs);
+ if (ret && ret != -EOPNOTSUPP)
+ goto out;
+ if (ret == -EOPNOTSUPP)
+ continue;
+ /*
+ * As the number of xattrs reserved by LSMs is not directly
+ * available, directly use the total number blob_sizes.lbs_xattr
+ * to keep the code simple, while being not the most efficient
+ * way.
+ */
+ ret = security_check_compact_filled_xattrs(new_xattrs,
+ blob_sizes.lbs_xattr,
+ &num_filled_xattrs);
+ if (ret < 0) {
+ ret = -ENOMEM;
+ goto out;
+ }
+ }
+
+ if (!num_filled_xattrs)
goto out;
- evm_xattr = lsm_xattr + 1;
- ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
+ ret = evm_inode_init_security(inode, new_xattrs,
+ new_xattrs + num_filled_xattrs);
if (ret)
goto out;
ret = initxattrs(inode, new_xattrs, fs_data);
out:
for (xattr = new_xattrs; xattr->value != NULL; xattr++)
kfree(xattr->value);
+ kfree(new_xattrs);
return (ret == -EOPNOTSUPP) ? 0 : ret;
}
EXPORT_SYMBOL(security_inode_init_security);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f553c370397e..57e5bc7c9ed8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -104,6 +104,8 @@
#include "audit.h"
#include "avc_ss.h"
+#define SELINUX_INODE_INIT_XATTRS 1
+
struct selinux_state selinux_state;
/* SECMARK reference count */
@@ -2868,11 +2870,11 @@ static int selinux_dentry_create_files_as(struct dentry
*dentry, int mode,
static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
const struct qstr *qstr,
- const char **name,
- void **value, size_t *len)
+ struct xattr *xattrs)
{
const struct task_security_struct *tsec = selinux_cred(current_cred());
struct superblock_security_struct *sbsec;
+ struct xattr *xattr = NULL;
u32 newsid, clen;
int rc;
char *context;
@@ -2899,16 +2901,18 @@ static int selinux_inode_init_security(struct inode
*inode, struct inode *dir,
!(sbsec->flags & SBLABEL_MNT))
return -EOPNOTSUPP;
- if (name)
- *name = XATTR_SELINUX_SUFFIX;
+ if (xattrs)
+ xattr = xattrs + selinux_blob_sizes.lbs_xattr;
+
+ if (xattr) {
+ xattr->name = XATTR_SELINUX_SUFFIX;
- if (value && len) {
rc = security_sid_to_context_force(&selinux_state, newsid,
&context, &clen);
if (rc)
return rc;
- *value = context;
- *len = clen;
+ xattr->value = context;
+ xattr->value_len = clen;
}
return 0;
@@ -6900,6 +6904,7 @@ struct lsm_blob_sizes selinux_blob_sizes
__lsm_ro_after_init = {
.lbs_ipc = sizeof(struct ipc_security_struct),
.lbs_msg_msg = sizeof(struct msg_security_struct),
.lbs_superblock = sizeof(struct superblock_security_struct),
+ .lbs_xattr = SELINUX_INODE_INIT_XATTRS,
};
#ifdef CONFIG_PERF_EVENTS
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index b6306d71c908..a7c3e4284754 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -52,6 +52,8 @@
#define SMK_RECEIVING 1
#define SMK_SENDING 2
+#define SMACK_INODE_INIT_XATTRS 4
+
#ifdef SMACK_IPV6_PORT_LABELING
static DEFINE_MUTEX(smack_ipv6_lock);
static LIST_HEAD(smk_ipv6_port_list);
@@ -939,26 +941,27 @@ static int smack_inode_alloc_security(struct inode *inode)
* @inode: the newly created inode
* @dir: containing directory object
* @qstr: unused
- * @name: where to put the attribute name
- * @value: where to put the attribute value
- * @len: where to put the length of the attribute
+ * @xattrs: where to put the attribute
*
* Returns 0 if it all works out, -ENOMEM if there's no memory
*/
static int smack_inode_init_security(struct inode *inode, struct inode *dir,
- const struct qstr *qstr, const char **name,
- void **value, size_t *len)
+ const struct qstr *qstr,
+ struct xattr *xattrs)
{
struct inode_smack *issp = smack_inode(inode);
struct smack_known *skp = smk_of_current();
struct smack_known *isp = smk_of_inode(inode);
struct smack_known *dsp = smk_of_inode(dir);
+ struct xattr *xattr = NULL;
int may;
- if (name)
- *name = XATTR_SMACK_SUFFIX;
+ if (xattrs)
+ xattr = xattrs + smack_blob_sizes.lbs_xattr;
+
+ if (xattr) {
+ xattr->name = XATTR_SMACK_SUFFIX;
- if (value && len) {
rcu_read_lock();
may = smk_access_entry(skp->smk_known, dsp->smk_known,
&skp->smk_rules);
@@ -976,11 +979,11 @@ static int smack_inode_init_security(struct inode *inode,
struct inode *dir,
issp->smk_flags |= SMK_INODE_CHANGED;
}
- *value = kstrdup(isp->smk_known, GFP_NOFS);
- if (*value == NULL)
+ xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
+ if (xattr->value == NULL)
return -ENOMEM;
- *len = strlen(isp->smk_known);
+ xattr->value_len = strlen(isp->smk_known);
}
return 0;
@@ -4785,6 +4788,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init
= {
.lbs_ipc = sizeof(struct smack_known *),
.lbs_msg_msg = sizeof(struct smack_known *),
.lbs_superblock = sizeof(struct superblock_smack),
+ .lbs_xattr = SMACK_INODE_INIT_XATTRS,
};
static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
--
2.25.1
Roberto Sassu
2022-Nov-23 09:52 UTC
[Ocfs2-devel] [PATCH v5 5/6] evm: Align evm_inode_init_security() definition with LSM infrastructure
From: Roberto Sassu <roberto.sassu at huawei.com>
Change the evm_inode_init_security() definition to align with the LSM
infrastructure, in preparation for moving IMA and EVM to that
infrastructure. Keep the existing behavior of including in the HMAC
calculation only the xattr the first LSM provides.
Changing the evm_inode_init_security() definition requires passing only the
xattr array allocated by security_inode_init_security(), instead of the
first LSM xattr and the place where the EVM xattr should be filled. In lieu
of passing the EVM xattr, EVM must position itself after the last filled
xattr (by checking the xattr name), since only the beginning of the xattr
array is given.
Currently, the LSM infrastructure makes sure that there is space for the
EVM xattr in the xattr array. If EVM is moved to the LSM infrastructure,
it will use the xattr reservation mechanism to achieve the same, as the
other LSMs.
Finally, make evm_inode_init_security() return value compatible with the
inode_init_security hook conventions, i.e. return -EOPNOTSUPP if it is not
setting an xattr.
EVM is a bit tricky, because xattrs is both an input and an output. If it
was just output, EVM should have returned zero if xattrs is NULL. But,
since xattrs is also input, EVM is unable to do its calculations, so return
-EOPNOTSUPP and handle this error in security_inode_init_security().
Don't change the return value in the inline function
evm_inode_init_security() in include/linux/evm.h, as the function will be
removed if EVM is moved to the LSM infrastructure.
Signed-off-by: Roberto Sassu <roberto.sassu at huawei.com>
---
include/linux/evm.h | 12 ++++++------
security/integrity/evm/evm_main.c | 20 +++++++++++++-------
security/security.c | 5 ++---
3 files changed, 21 insertions(+), 16 deletions(-)
diff --git a/include/linux/evm.h b/include/linux/evm.h
index aa63e0b3c0a2..3bb2ae9fe098 100644
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -35,9 +35,9 @@ extern int evm_inode_removexattr(struct user_namespace
*mnt_userns,
struct dentry *dentry, const char *xattr_name);
extern void evm_inode_post_removexattr(struct dentry *dentry,
const char *xattr_name);
-extern int evm_inode_init_security(struct inode *inode,
- const struct xattr *xattr_array,
- struct xattr *evm);
+extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
+ const struct qstr *qstr,
+ struct xattr *xattrs);
extern bool evm_revalidate_status(const char *xattr_name);
extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);
extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
@@ -108,9 +108,9 @@ static inline void evm_inode_post_removexattr(struct dentry
*dentry,
return;
}
-static inline int evm_inode_init_security(struct inode *inode,
- const struct xattr *xattr_array,
- struct xattr *evm)
+static inline int evm_inode_init_security(struct inode *inode, struct inode
*dir,
+ const struct qstr *qstr,
+ struct xattr *xattrs)
{
return 0;
}
diff --git a/security/integrity/evm/evm_main.c
b/security/integrity/evm/evm_main.c
index 23d484e05e6f..0a312cafb7de 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -845,23 +845,29 @@ void evm_inode_post_setattr(struct dentry *dentry, int
ia_valid)
/*
* evm_inode_init_security - initializes security.evm HMAC value
*/
-int evm_inode_init_security(struct inode *inode,
- const struct xattr *lsm_xattr,
- struct xattr *evm_xattr)
+int evm_inode_init_security(struct inode *inode, struct inode *dir,
+ const struct qstr *qstr,
+ struct xattr *xattrs)
{
struct evm_xattr *xattr_data;
+ struct xattr *xattr, *evm_xattr;
int rc;
- if (!(evm_initialized & EVM_INIT_HMAC) ||
- !evm_protected_xattr(lsm_xattr->name))
- return 0;
+ if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
+ !evm_protected_xattr(xattrs->name))
+ return -EOPNOTSUPP;
+
+ for (xattr = xattrs; xattr->value != NULL; xattr++)
+ ;
+
+ evm_xattr = xattr;
xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
if (!xattr_data)
return -ENOMEM;
xattr_data->data.type = EVM_XATTR_HMAC;
- rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
+ rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
if (rc < 0)
goto out;
diff --git a/security/security.c b/security/security.c
index 26aaa5850867..d256bd223ef4 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1184,9 +1184,8 @@ int security_inode_init_security(struct inode *inode,
struct inode *dir,
if (!num_filled_xattrs)
goto out;
- ret = evm_inode_init_security(inode, new_xattrs,
- new_xattrs + num_filled_xattrs);
- if (ret)
+ ret = evm_inode_init_security(inode, dir, qstr, new_xattrs);
+ if (ret && ret != -EOPNOTSUPP)
goto out;
ret = initxattrs(inode, new_xattrs, fs_data);
out:
--
2.25.1
Roberto Sassu
2022-Nov-23 09:52 UTC
[Ocfs2-devel] [PATCH v5 6/6] evm: Support multiple LSMs providing an xattr
From: Roberto Sassu <roberto.sassu at huawei.com>
Currently, evm_inode_init_security() processes a single LSM xattr from
the array passed by security_inode_init_security(), and calculates the
HMAC on it and other inode metadata.
Given that initxattrs() callbacks, called by
security_inode_init_security(), expect that this array is terminated when
the xattr name is set to NULL, reuse the same assumption to scan all xattrs
and to calculate the HMAC on all of them.
Signed-off-by: Roberto Sassu <roberto.sassu at huawei.com>
---
security/integrity/evm/evm.h | 2 ++
security/integrity/evm/evm_crypto.c | 9 ++++++++-
security/integrity/evm/evm_main.c | 16 +++++++++++-----
3 files changed, 21 insertions(+), 6 deletions(-)
diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h
index f8b8c5004fc7..f799d72a59fa 100644
--- a/security/integrity/evm/evm.h
+++ b/security/integrity/evm/evm.h
@@ -46,6 +46,8 @@ struct evm_digest {
char digest[IMA_MAX_DIGEST_SIZE];
} __packed;
+int evm_protected_xattr(const char *req_xattr_name);
+
int evm_init_key(void);
int evm_update_evmxattr(struct dentry *dentry,
const char *req_xattr_name,
diff --git a/security/integrity/evm/evm_crypto.c
b/security/integrity/evm/evm_crypto.c
index 708de9656bbd..68f99faac316 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -389,6 +389,7 @@ int evm_init_hmac(struct inode *inode, const struct xattr
*lsm_xattr,
char *hmac_val)
{
struct shash_desc *desc;
+ const struct xattr *xattr;
desc = init_desc(EVM_XATTR_HMAC, HASH_ALGO_SHA1);
if (IS_ERR(desc)) {
@@ -396,7 +397,13 @@ int evm_init_hmac(struct inode *inode, const struct xattr
*lsm_xattr,
return PTR_ERR(desc);
}
- crypto_shash_update(desc, lsm_xattr->value, lsm_xattr->value_len);
+ for (xattr = lsm_xattr; xattr->name != NULL; xattr++) {
+ if (!evm_protected_xattr(xattr->name))
+ continue;
+
+ crypto_shash_update(desc, xattr->value, xattr->value_len);
+ }
+
hmac_add_misc(desc, inode, EVM_XATTR_HMAC, hmac_val);
kfree(desc);
return 0;
diff --git a/security/integrity/evm/evm_main.c
b/security/integrity/evm/evm_main.c
index 0a312cafb7de..1cf6871a0019 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -305,7 +305,7 @@ static int evm_protected_xattr_common(const char
*req_xattr_name,
return found;
}
-static int evm_protected_xattr(const char *req_xattr_name)
+int evm_protected_xattr(const char *req_xattr_name)
{
return evm_protected_xattr_common(req_xattr_name, false);
}
@@ -851,14 +851,20 @@ int evm_inode_init_security(struct inode *inode, struct
inode *dir,
{
struct evm_xattr *xattr_data;
struct xattr *xattr, *evm_xattr;
+ bool evm_protected_xattrs = false;
int rc;
- if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
- !evm_protected_xattr(xattrs->name))
+ if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs)
return -EOPNOTSUPP;
- for (xattr = xattrs; xattr->value != NULL; xattr++)
- ;
+ for (xattr = xattrs; xattr->value != NULL; xattr++) {
+ if (evm_protected_xattr(xattr->name))
+ evm_protected_xattrs = true;
+ }
+
+ /* EVM xattr not needed. */
+ if (!evm_protected_xattrs)
+ return -EOPNOTSUPP;
evm_xattr = xattr;
--
2.25.1
Mimi Zohar
2022-Nov-23 12:28 UTC
[Ocfs2-devel] [PATCH v5 0/6] evm: Prepare for moving to the LSM infrastructure
Hi Roberto, On Wed, 2022-11-23 at 10:51 +0100, Roberto Sassu wrote:> From: Roberto Sassu <roberto.sassu at huawei.com> > > One of the challenges that must be tackled to move IMA and EVM to the LSM > infrastructure is to ensure that EVM is capable to correctly handle > multiple stacked LSMs providing an xattr at file creation. At the moment, > there are few issues that would prevent a correct integration. This patch > set aims at solving them.Let's take a step back and understand the purpose of this patch set. Regardless of whether IMA and EVM are moved to the "LSM infrastructure", EVM needs to support per LSM xattrs. A side affect is the removal of the security_old_inode_init_security hook. This patch set cover letter and patch descriptions should be limited to EVM support for per LSM (multiple) xattrs. The motivation, concerns, and problems of making IMA and EVM LSMs will be documented in the patch set that actual makes them LSMs. Please remove all references to "move IMA and EVM to the LSM infrastructure". When EVM was upstreamed, there were filesystem limitations on the number and size of the extended attributes. In addition there were performance concerns, which resulted in staging the LSM, IMA and EVM xattrs, before calling initxattrs to write them at the same time. With this patch set, not only are per LSM xattrs supported, but multiple per LSM xattrs are supported as well. Have the size limitation concerns been addressed by the different filesystems? If not, then at minimum this patch set needs to at least mention it and the possible ramifications. -- thanks, Mimi