Skip to contentSkip to conversation

integrity: new hooks

RFC PATCH In review Mimi Zohar 5 participants 10 messages Mar 8, 2007 Security (LSM)

lore
Share & tools
lore

Mimi Zohar

author
#0 lore raw

RFC PATCH 1/6 integrity: new hooks

This patch adds integrity hooks used to implement an integrity service provider and updates the previously submitted dummy provider to support these new hooks.

security/integrity_dummy.c +71 -2
Index: linux-2.6.21-rc3-mm2/security/integrity_dummy.c
===================================================================
@@ -3,7 +3,7 @@
  *
  * Instantiate integrity subsystem
  *
- * Copyright (C) 2005,2006 IBM Corporation
+ * Copyright (C) 2005,2006,2007 IBM Corporation
  * Author: Mimi Zohar <[email protected]>
  *
  *      This program is free software; you can redistribute it and/or modify

@@ -62,9 +62,78 @@ static void dummy_measure(struct dentry 
 	return;
 }
 
+static int dummy_inode_alloc_integrity(struct inode *inode)
+{
+	return 0;
+}
+
+static void dummy_inode_free_integrity(struct inode *inode)
+{
+	return;
+}
+
+static void dummy_inode_init_integrity(struct inode *inode, struct inode *dir,
+				      char **name, void **value, size_t * len)
+{
+	return;
+}
+
+static void dummy_file_free_integrity(struct file *file)
+{
+	return;
+}
+
+static int dummy_inode_setxattr(struct dentry *dentry, char *name, void *value,
+				size_t size, int flags)
+{
+	if (!strncmp(name, XATTR_SECURITY_PREFIX,
+		     sizeof(XATTR_SECURITY_PREFIX) - 1) &&
+	    !capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	return 0;
+}
+
+static void dummy_inode_post_setxattr(struct dentry *dentry, char *name)
+{
+}
+
+static void dummy_d_instantiate(struct dentry *dentry, struct inode *inode)
+{
+	return;
+}
+
 struct integrity_operations dummy_integrity_ops = {
 	.verify_metadata = dummy_verify_metadata,
 	.verify_data = dummy_verify_data,
-	.measure = dummy_measure
+	.measure = dummy_measure,
+	.inode_setxattr = dummy_inode_setxattr,
+	.inode_post_setxattr = dummy_inode_post_setxattr,
+	.inode_alloc_integrity = dummy_inode_alloc_integrity,
+	.inode_init_integrity = dummy_inode_init_integrity,
+	.inode_free_integrity = dummy_inode_free_integrity,
+	.file_free_integrity = dummy_file_free_integrity,
+	.d_instantiate = dummy_d_instantiate
 };
 
+#define set_to_dummy_if_null(ops, function)				\
+	do {								\
+		if (!ops->function) {					\
+			ops->function = dummy_##function;		\
+			printk(KERN_INFO "Had to override the " #function \
+			" security operation with the dummy one.\n");\
+			}						\
+	} while (0)
+
+void integrity_fixup_ops(struct integrity_operations *ops)
+{
+	set_to_dummy_if_null(ops, verify_metadata);
+	set_to_dummy_if_null(ops, verify_data);
+	set_to_dummy_if_null(ops, measure);
+	set_to_dummy_if_null(ops, inode_setxattr);
+	set_to_dummy_if_null(ops, inode_post_setxattr);
+	set_to_dummy_if_null(ops, inode_alloc_integrity);
+	set_to_dummy_if_null(ops, inode_init_integrity);
+	set_to_dummy_if_null(ops, inode_free_integrity);
+	set_to_dummy_if_null(ops, file_free_integrity);
+	set_to_dummy_if_null(ops, d_instantiate);
+}
security/integrity_dummy.h +2 -1
Index: linux-2.6.21-rc3-mm2/security/integrity_dummy.h
===================================================================
@@ -1,7 +1,7 @@
 /*
  * integrity_dummy.h
  *
- * Copyright (C) 2005,2006 IBM Corporation
+ * Copyright (C) 2005,2006,2007 IBM Corporation
  * Author: Mimi Zohar <[email protected]>
  *
  *      This program is free software; you can redistribute it and/or modify

@@ -10,3 +10,4 @@
  */
 
 extern struct integrity_operations dummy_integrity_ops;
+extern void integrity_fixup_ops(struct integrity_operations *ops);
include/linux/integrity.h +143 -6

196 lines not on this page · raw message

security/integrity.c +2 -1
Index: linux-2.6.21-rc3-mm2/security/integrity.c
===================================================================
@@ -3,7 +3,7 @@
  *
  * register integrity subsystem
  *
- * Copyright (C) 2005,2006 IBM Corporation
+ * Copyright (C) 2005,2006,2007 IBM Corporation
  * Author: Mimi Zohar <[email protected]>
  *
  *      This program is free software; you can redistribute it and/or modify

@@ -27,6 +27,7 @@ int register_integrity(struct integrity_
 		return -EAGAIN;
 
 	integrity_ops = ops;
+	integrity_fixup_ops(integrity_ops);
 	return 0;
 }
#1 lore raw

security/integrity_dummy.c static void dummy_measure(struct dentry · line 94

Quoted 9 lines · * Mimi Zohar ([email protected]) wrote:
security/integrity_dummy.c +9 -0
+static int dummy_inode_setxattr(struct dentry *dentry, char *name, void *value,
+				size_t size, int flags)
+{
+	if (!strncmp(name, XATTR_SECURITY_PREFIX,
+		     sizeof(XATTR_SECURITY_PREFIX) - 1) &&
+	    !capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	return 0;
+}

Hold on, what is all this? Duplication of all of this code is a no go.

thanks,
-chris

#2 lore raw
Quoted 12 lines · Chris Wright

security/integrity_dummy.c static void dummy_measure(struct dentry · line 94

Quoted 9 lines · * Mimi Zohar ([email protected]) wrote:
security/integrity_dummy.c +9 -0
+static int dummy_inode_setxattr(struct dentry *dentry, char *name, void *value,
+				size_t size, int flags)
+{
+	if (!strncmp(name, XATTR_SECURITY_PREFIX,
+		     sizeof(XATTR_SECURITY_PREFIX) - 1) &&
+	    !capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	return 0;
+}

Hold on, what is all this? Duplication of all of this code is a no go.

It's unfortunate, agreed, but

use of LSM as an integrity framework was also a no-go.

Options?

thanks,
-serge

#3 lore raw
Quoted 4 lines · * Serge E. Hallyn ([email protected]) wrote:

It's unfortunate, agreed, but
use of LSM as an integrity framework was also a no-go.

Options?

There's too much dup because stuff like above is just access control not integrity measurement. Need to break off the parts that really are different. But I don't have a great option offhand, I recognize the complication.

thanks,
-chris

#4 lore raw
In reply to Serge E. Hallyn
Quoted 4 lines · --- "Serge E. Hallyn

It's unfortunate, agreed, but

use of LSM as an integrity framework was also a
no-go.

You're going to have to justify this assertion.
I know of at least one work-in-progress for which
LSM works just fine. Not to mention the Integrity
claims of SELinux.

Casey Schaufler
[email protected]

#5 lore raw
Quoted 10 lines · Casey Schaufler
Quoted 4 lines · --- "Serge E. Hallyn

It's unfortunate, agreed, but

use of LSM as an integrity framework was also a
no-go.

You're going to have to justify this assertion.

You misunderstand. I wasn't saying it wouldn't work :) I was saying that it's been said repeatedly that evm should be implemented as an integrity, not security, module.

I think it should be done as both. The part which measures the integrity of files should be an integrity subsystem. The part which uses those results to either allow/refuse actions or take some other action (i.e. shut down the system) should be an lsm.

Quoted 3 lines

I know of at least one work-in-progress for which
LSM works just fine. Not to mention the Integrity
claims of SELinux.

-serge

#6 lore raw
Quoted 4 lines · Serge E. Hallyn

I think it should be done as both. The part which measures the integrity of files should be an integrity subsystem. The part which uses those results to either allow/refuse actions or take some other action (i.e. shut down the system) should be an lsm.

That would be good - the allow/deny parts, being security, can use the existing LSM hooks, and the integrity part can use the LIM hooks.

Umm... wait a minute - *what* Linux Integrity Module hooks? :)

#7 lore raw
Quoted 8 lines · Quoting [email protected] ([email protected]):
Quoted 4 lines · Serge E. Hallyn

I think it should be done as both. The part which measures the integrity of files should be an integrity subsystem. The part which uses those results to either allow/refuse actions or take some other action (i.e. shut down the system) should be an lsm.

That would be good - the allow/deny parts, being security, can use the existing LSM hooks, and the integrity part can use the LIM hooks.

Yes, the only problem is that there will still be 'duplication' at some call sites. For instance even if something is only doing measurements, at setxattr, for instance, it still needs to be able to refuse a change if it can't allocate memory to store measurement data. So we still might need an fsnotify-like approach to consolidate security and integrity hooks. (As Mimi pointed out, I guess it'll have to make sure to call the security ones first)

I suppose something more clever might be doable - for instance since we are pairing the measurement module with an enforcement module, the enforcement module could kmalloc() what the measurement module will need for data and return -ENOMEM if need be, then the measurement module just fills the data in. If there's no place for it to store the data, then it knows that the enforcement module must be ok not having that data.

Quoted 1 line

Umm... wait a minute - *what* Linux Integrity Module hooks? :)

-serge

author
#8 lore raw
In reply to [email protected]
Quoted 10 lines · On Thu, 2007-03-08 at 15:38 -0500, [email protected] wrote:
Quoted 4 lines · Serge E. Hallyn

I think it should be done as both. The part which measures the integrity of files should be an integrity subsystem. The part which uses those results to either allow/refuse actions or take some other action (i.e. shut down the system) should be an lsm.

That would be good - the allow/deny parts, being security, can use the existing LSM hooks, and the integrity part can use the LIM hooks.

Umm... wait a minute - *what* Linux Integrity Module hooks? :)

Hm, integrity-service-api-and-dummy-provider.patch contains:
integrity_verify_metadata, integrity_verify_data, and integrity_measure, which could be referred to as either LIM hooks or as the API. This patch set adds 8 new LIM hooks.

Mimi Zohar

#9 lore raw
In reply to Casey Schaufler
Quoted 6 lines · * Casey Schaufler ([email protected]) wrote:
Quoted 2 lines · --- "Serge E. Hallyn

It's unfortunate, agreed, but

Quoted 7 lines
Quoted 2 lines

use of LSM as an integrity framework was also a
no-go.

You're going to have to justify this assertion.
I know of at least one work-in-progress for which
LSM works just fine. Not to mention the Integrity
claims of SELinux.

Serge is referring to the objections to EVM/IMA
as LSM because it was not doing access control,
rather integrity measurements. It's all in
somewhere the archives.

thanks,
-chris