Add support for architecture-specific IMA policies

Hi Nayna,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on integrity/next-integrity]
[also build test WARNING on next-20180727]
[cannot apply to v4.18-rc6]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Eric-Richter/ima-add-support-for-arch-specific-policies/20180728-072442
base:   https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
reproduce:
         # apt-get install sparse
         make ARCH=x86_64 allmodconfig
         make C=1 CF=-D__CHECK_ENDIAN__

sparse warnings: (new ones prefixed by >>)

Quoted 2 lines

Quoted 2 lines

security/integrity/ima/ima_policy.c:198:23: sparse: symbol 'arch_policy_rules' was not declared. Should it be static? security/integrity/ima/ima_policy.c:199:23: sparse: symbol 'arch_policy_entry' was not declared. Should it be static?

include/linux/slab.h:631:13: sparse: undefined identifier '__builtin_mul_overflow' include/linux/slab.h:631:13: sparse: not a function <noident> include/linux/slab.h:631:13: sparse: call with no type!

Please review and possibly fold the followup patch.

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation

IMA can verify the signature of kernel images loaded with kexec_file_load, but can not verify images loaded with the regular kexec_load syscall. Therefore, the appraisal will automatically fail during kexec_load when an appraise policy rule is set for func=KEXEC_KERNEL_CHECK. This can be used to effectively disable the kexec_load syscall, while still allowing the kexec_file_load to operate so long as the target kernel image is signed.

However, this conflicts with CONFIG_KEXEC_VERIFY_SIG. If that option is enabled and there is an appraise rule set, then the target kernel would have to be verifiable by both IMA and the architecture specific kernel verification procedure.

This patch adds a new func= for IMA appraisal specifically for the original kexec_load syscall. Therefore, the kexec_load syscall can be effectively disabled via IMA policy, leaving the kexec_file_load syscall able to do its own signature verification, and not require it to be signed via IMA. To retain compatibility, the existing func=KEXEC_KERNEL_CHECK flag is unchanged, and thus enables appraisal for both kexec syscalls.

Quoted 12 lines · Eric Richter

IMA can verify the signature of kernel images loaded with kexec_file_load, but can not verify images loaded with the regular kexec_load syscall. Therefore, the appraisal will automatically fail during kexec_load when an appraise policy rule is set for func=KEXEC_KERNEL_CHECK. This can be used to effectively disable the kexec_load syscall, while still allowing the kexec_file_load to operate so long as the target kernel image is signed.

However, this conflicts with CONFIG_KEXEC_VERIFY_SIG. If that option is enabled and there is an appraise rule set, then the target kernel would have to be verifiable by both IMA and the architecture specific kernel verification procedure.

Quoted 6 lines

This patch adds a new func= for IMA appraisal specifically for the original kexec_load syscall. Therefore, the kexec_load syscall can be effectively disabled via IMA policy, leaving the kexec_file_load syscall able to do its own signature verification, and not require it to be signed via IMA. To retain compatibility, the existing func=KEXEC_KERNEL_CHECK flag is unchanged, and thus enables appraisal for both kexec syscalls.

This seems like a roundabout way to disallow the kexec_load syscall. Wouldn't it make more sense to simply disallow kexec_load any time CONFIG_KEXEC_VERIFY_SIG is enabled, since it effectively renders that option impotent? Or has that idea already been rejected?

Quoted 20 lines · Seth Forshee

Quoted 12 lines · Eric Richter

IMA can verify the signature of kernel images loaded with kexec_file_load, but can not verify images loaded with the regular kexec_load syscall. Therefore, the appraisal will automatically fail during kexec_load when an appraise policy rule is set for func=KEXEC_KERNEL_CHECK. This can be used to effectively disable the kexec_load syscall, while still allowing the kexec_file_load to operate so long as the target kernel image is signed.

However, this conflicts with CONFIG_KEXEC_VERIFY_SIG. If that option is enabled and there is an appraise rule set, then the target kernel would have to be verifiable by both IMA and the architecture specific kernel verification procedure.

Quoted 6 lines

This patch adds a new func= for IMA appraisal specifically for the original kexec_load syscall. Therefore, the kexec_load syscall can be effectively disabled via IMA policy, leaving the kexec_file_load syscall able to do its own signature verification, and not require it to be signed via IMA. To retain compatibility, the existing func=KEXEC_KERNEL_CHECK flag is unchanged, and thus enables appraisal for both kexec syscalls.

Quoted 4 lines

This seems like a roundabout way to disallow the kexec_load syscall. Wouldn't it make more sense to simply disallow kexec_load any time CONFIG_KEXEC_VERIFY_SIG is enabled, since it effectively renders that option impotent? Or has that idea already been rejected?

Agreed!  We can modify the "case LOADING_KEXEC_IMAGE" in ima_load_data() to prevent the kexec_load based on CONFIG_KEXEC_VERIFY_SIG.

The architecture specific policy would only include the IMA appraise rule if CONFIG_KEXEC_VERIFY_SIG was not defined.

Quoted 26 lines · Mimi Zohar

Quoted 20 lines · Seth Forshee

Quoted 12 lines · Eric Richter

IMA can verify the signature of kernel images loaded with kexec_file_load, but can not verify images loaded with the regular kexec_load syscall. Therefore, the appraisal will automatically fail during kexec_load when an appraise policy rule is set for func=KEXEC_KERNEL_CHECK. This can be used to effectively disable the kexec_load syscall, while still allowing the kexec_file_load to operate so long as the target kernel image is signed.

However, this conflicts with CONFIG_KEXEC_VERIFY_SIG. If that option is enabled and there is an appraise rule set, then the target kernel would have to be verifiable by both IMA and the architecture specific kernel verification procedure.

Quoted 6 lines

This patch adds a new func= for IMA appraisal specifically for the original kexec_load syscall. Therefore, the kexec_load syscall can be effectively disabled via IMA policy, leaving the kexec_file_load syscall able to do its own signature verification, and not require it to be signed via IMA. To retain compatibility, the existing func=KEXEC_KERNEL_CHECK flag is unchanged, and thus enables appraisal for both kexec syscalls.

Quoted 4 lines

This seems like a roundabout way to disallow the kexec_load syscall. Wouldn't it make more sense to simply disallow kexec_load any time CONFIG_KEXEC_VERIFY_SIG is enabled, since it effectively renders that option impotent? Or has that idea already been rejected?

Quoted 6 lines

Agreed!  We can modify the "case LOADING_KEXEC_IMAGE" in ima_load_data() to prevent the kexec_load based on CONFIG_KEXEC_VERIFY_SIG.

The architecture specific policy would only include the IMA appraise rule if CONFIG_KEXEC_VERIFY_SIG was not defined.

After looking at this some more I'm having second thoughts about my suggestion. As a distro we produce a kernel that needs to be flexible enough for a variety of scenarios, and if we completely close off the ability to load an unsigned kernel for kexec that's almost certainly going to end up breaking some use cases.

So I think it is necessary to make this a run-time decision rather than a compile-time decision. The patch as provided does this based on whether or not the kernel was booted under secure boot. That might be reasonable, though I still find this mechanism kind of awkward.

It seems
like ideally there would instead be some logic that would accept the image if the KEXEC_VERIFY_SIG verification had passed, and otherwise require IMA signature verification.