ima: change how MODULE_SIG_FORCE is checked on modules checking policy
Subsystems (5)
v3 cover ima: change how MODULE_SIG_FORCE is checked on modules checking policy
This patchset ensure that IMA's modules checking policy:
measure func=MODULE_CHECK uid=0
rely on the correct value of CONFIG_MODULE_SIG_FORCE, since the way it is today the code completely ignores the module.sig_enforce cmdline param, which behaves in a OR logic with the CONFIG value (CONFIG_MODULE_SIG_FORCE || module.sig_enforce). That said, everytime a module would load, in the current checking code, when the kernel was not compiled with the CONFIG set the call to init_module syscall fails with -EACCES:
# strace -f -v modprobe <any-module> | grep init_module init_module(0x55b9bcc9bba0, 17763, "") = -1 EACCES (Permission denied)
With this patchset the result would rely on the module.sig_enforce cmdline as well. Once the CONFIG is not set, but the param is, the result would be 'success', as it should be:
# strace -f -v modprobe <any-module> | grep init_module init_module(0x7f9602d6e010, 386646, "") = 0
The patchset was tested in two different kernels: 4.13.6 (Fedora 27) and 4.14.0-rc4 (integrity-next tree).
Changes:
v3:
1/2 - added dummy is_module_sig_enforced() function to the case where CONFIG_MODULES is not set and IMA=y.
v2:
1/2 - code changes to correct checkpatch.pl warnings.
Bruno E. O. Meneguele (2):
module: export module signature enforcement status
ima: check signature enforcement against cmdline param instead of
CONFIG
include/linux/module.h | 7 +++++++ kernel/module.c | 10 ++++++++++ security/integrity/ima/ima_main.c | 6 +++--- 3 files changed, 20 insertions(+), 3 deletions(-)
Signature · 6 lines
2.13.6 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
PATCH v3 1/2 module: export module signature enforcement status
A static variable sig_enforce is used as status var to indicate the real value of CONFIG_MODULE_SIG_FORCE, once this one is set the var will hold true, but if the CONFIG is not set the status var will hold whatever value is present in the module.sig_enforce kernel cmdline param: true when =1 and false when =0 or not present.
Considering this cmdline param take place over the CONFIG value when it's not set, other places in the kernel could misbehave since they would have only the CONFIG_MODULE_SIG_FORCE value to rely on. Exporting this status var allows the kernel to rely in the effective value of module signature enforcement, being it from CONFIG value or cmdline param.
--- include/linux/module.h | 7 +++++++ kernel/module.c | 10 ++++++++++ 2 files changed, 17 insertions(+)
include/linux/module.h +7 -0
@@ -639,6 +639,8 @@ static inline bool is_livepatch_module(struct module *mod) }#endif /* CONFIG_LIVEPATCH */ +bool is_module_sig_enforced (void ); +#else /* !CONFIG_MODULES... */ static inline struct module *__module_address (unsigned long addr)
@@ -753,6 +755,11 @@ static inline bool module_requested_async_probing(struct module *module) return false; } +static inline bool is_module_sig_enforced (void ) +{ +return false; +} +#endif /* CONFIG_MODULES */ #ifdef CONFIG_SYSFS
kernel/module.c +10 -0
@@ -278,6 +278,16 @@ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);module_param (sig_enforce, bool_enable_only,0644 );#endif /* !CONFIG_MODULE_SIG_FORCE */ +/* +* Export sig_enforce kernel cmdline parameter to allow other subsystems rely +* on that instead of directly to CONFIG_MODULE_SIG_FORCE config. +*/ +bool is_module_sig_enforced (void ) +{ +return sig_enforce; +} +EXPORT_SYMBOL (is_module_sig_enforced); +/* Block module loading/unloading? */ int modules_disabled =0 ;core_param (nomodule, modules_disabled, bint,0 );
Signature · 6 lines
2.13.6 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
PATCH v3 2/2 ima: check signature enforcement against cmdline param instead of CONFIG
In reply to Bruno E. O. MenegueleWhen the user requests MODULE_CHECK policy and its kernel is compiled with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just those loaded in initram time. One option the user would have would be set a kernel cmdline param (module.sig_enforce) to true, but the IMA module check code doesn't rely on this value, it checks just CONFIG_MODULE_SIG_FORCE.
This patch solves this problem checking for the exported value of module.sig_enforce cmdline param intead of CONFIG_MODULE_SIG_FORCE, which holds the effective value (CONFIG || param).
--- security/integrity/ima/ima_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
security/integrity/ima/ima_main.c +3 -3
@@ -356,12 +356,12 @@ void ima_post_path_mknod(struct dentry *dentry)*/ int ima_read_file (struct file *file,enum kernel_read_file_id read_id) { +bool sig_enforce =is_module_sig_enforced (); +if (!file && read_id ==READING_MODULE ) { -#ifndef CONFIG_MODULE_SIG_FORCE -if ((ima_appraise &IMA_APPRAISE_MODULES ) && +if (!sig_enforce && (ima_appraise &IMA_APPRAISE_MODULES ) && (ima_appraise &IMA_APPRAISE_ENFORCE ))return -EACCES ;/* INTEGRITY_UNKNOWN */ -#endif return 0 ;/* We rely on module signature checking */ }return 0 ;
Signature · 6 lines
2.13.6 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG
Quoted 21 lines · Bruno E. O. Meneguele
When the user requests
MODULE_CHECKpolicy and its kernel is compiled withCONFIG_MODULE_SIG_FORCEnot set, all modules would not load, just those loaded in initram time. One option the user would have would be set a kernel cmdline param (module.sig_enforce) to true, but the IMA module check code doesn't rely on this value, it checks justCONFIG_MODULE_SIG_FORCE.This patch solves this problem checking for the exported value of module.sig_enforce cmdline param intead of
CONFIG_MODULE_SIG_FORCE, which holds the effective value (CONFIG || param).Signed-off-by Bruno E. O. Meneguele <[email protected]>--- security/integrity/ima/ima_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)security/integrity/ima/ima_main.c +0
-0
security/integrity/ima/ima_main.c void ima_post_path_mknod(struct dentry *dentry) · line 361
Quoted 6 lines
security/integrity/ima/ima_main.c +2
-0@@ -356,12 +356,12 @@ void ima_post_path_mknod(struct dentry *dentry)*/ int ima_read_file (struct file *file,enum kernel_read_file_id read_id) { +bool sig_enforce =is_module_sig_enforced (); +if (!file && read_id ==READING_MODULE ) {
The only reason for getting here is that you're using the old module load syscall. ?Is there a reason for not using the new one, which passes the file descriptor?
thanks,
Mimi
security/integrity/ima/ima_main.c void ima_post_path_mknod(struct dentry *dentry) · line 367
Quoted 9 lines
security/integrity/ima/ima_main.c +1
-3-#ifndef CONFIG_MODULE_SIG_FORCE -if ((ima_appraise &IMA_APPRAISE_MODULES ) && +if (!sig_enforce && (ima_appraise &IMA_APPRAISE_MODULES ) && (ima_appraise &IMA_APPRAISE_ENFORCE ))return -EACCES ;/* INTEGRITY_UNKNOWN */ -#endif return 0 ;/* We rely on module signature checking */ }return 0 ;
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG
Quoted 33 lines · Mimi Zohar
Quoted 21 lines · Bruno E. O. Meneguele
When the user requests
MODULE_CHECKpolicy and its kernel is compiled withCONFIG_MODULE_SIG_FORCEnot set, all modules would not load, just those loaded in initram time. One option the user would have would be set a kernel cmdline param (module.sig_enforce) to true, but the IMA module check code doesn't rely on this value, it checks justCONFIG_MODULE_SIG_FORCE.This patch solves this problem checking for the exported value of module.sig_enforce cmdline param intead of
CONFIG_MODULE_SIG_FORCE, which holds the effective value (CONFIG || param).Signed-off-by Bruno E. O. Meneguele <[email protected]>--- security/integrity/ima/ima_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)security/integrity/ima/ima_main.c +0
-0security/integrity/ima/ima_main.c void ima_post_path_mknod(struct dentry *dentry) · line 361
Quoted 6 lines
security/integrity/ima/ima_main.c +2
-0@@ -356,12 +356,12 @@ void ima_post_path_mknod(struct dentry *dentry)*/ int ima_read_file (struct file *file,enum kernel_read_file_id read_id) { +bool sig_enforce =is_module_sig_enforced (); +if (!file && read_id ==READING_MODULE ) {The only reason for getting here is that you're using the old module load syscall. Is there a reason for not using the new one, which passes the file descriptor?
Quoted 4 lines
thanks,
Mimi
Basicaly because the way kmod handles compressed (gz/xz) modules. The way it's today would require major changes in the code or some kind of memfd_create() + xattrs reassignement in order to finit_module() be used correctly.
Considering it would take some time to be accepted or even to figure out the correct way to tackle it, the current IMA module check code works aside kernel module signature validation, which is fine for now for me, but has the problem that this patch tries to solve in the CONFIG_MODULE_SIG_FORCE check (ignoring module.sig_enforce cmdline param).
Quoted 11 lines
Quoted 9 lines
security/integrity/ima/ima_main.c +1
-3-#ifndef CONFIG_MODULE_SIG_FORCE -if ((ima_appraise &IMA_APPRAISE_MODULES ) && +if (!sig_enforce && (ima_appraise &IMA_APPRAISE_MODULES ) && (ima_appraise &IMA_APPRAISE_ENFORCE ))return -EACCES ;/* INTEGRITY_UNKNOWN */ -#endif return 0 ;/* We rely on module signature checking */ }return 0 ;
Signature · 6 lines
bmeneg
PGP Key: http://bmeneg.com/pubkey.txt
[ Part 2, Application/PGP-SIGNATURE (Name: "signature.asc") 499 bytes. ]
[ Unable to print this part. ]Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG
Quoted 39 lines · Bruno E. O. Meneguele
Quoted 17 lines · Mimi Zohar
Quoted 16 lines · Bruno E. O. Meneguele
When the user requests
MODULE_CHECKpolicy and its kernel is compiled withCONFIG_MODULE_SIG_FORCEnot set, all modules would not load, just those loaded in initram time. One option the user would have would be set a kernel cmdline param (module.sig_enforce) to true, but the IMA module check code doesn't rely on this value, it checks justCONFIG_MODULE_SIG_FORCE.This patch solves this problem checking for the exported value of module.sig_enforce cmdline param intead of
CONFIG_MODULE_SIG_FORCE, which holds the effective value (CONFIG || param).Signed-off-by Bruno E. O. Meneguele <[email protected]>--- security/integrity/ima/ima_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)Quoted 15 lines
security/integrity/ima/ima_main.c void ima_post_path_mknod(struct dentry *dentry) · line 361
Quoted 11 lines
security/integrity/ima/ima_main.c +2
-0@@ -356,12 +356,12 @@ void ima_post_path_mknod(struct dentry *dentry)*/ int ima_read_file (struct file *file,enum kernel_read_file_id read_id) { +bool sig_enforce =is_module_sig_enforced (); +if (!file && read_id ==READING_MODULE ) {The only reason for getting here is that you're using the old module load syscall. ?Is there a reason for not using the new one, which passes the file descriptor?
Basicaly because the way kmod handles compressed (gz/xz) modules. The way it's today would require major changes in the code or some kind of
memfd_create()+ xattrs reassignement in order tofinit_module()be used correctly.
Quoted 6 lines
Considering it would take some time to be accepted or even to figure out the correct way to tackle it, the current IMA module check code works aside kernel module signature validation, which is fine for now for me, but has the problem that this patch tries to solve in the
CONFIG_MODULE_SIG_FORCEcheck (ignoring module.sig_enforce cmdline param).
Thank you for the reasoning. ?BTW, these patches are now queued.
Quoted 12 lines
Quoted 11 lines
security/integrity/ima/ima_main.c void ima_post_path_mknod(struct dentry *dentry) · line 367
Quoted 9 lines
security/integrity/ima/ima_main.c +1
-3-#ifndef CONFIG_MODULE_SIG_FORCE -if ((ima_appraise &IMA_APPRAISE_MODULES ) && +if (!sig_enforce && (ima_appraise &IMA_APPRAISE_MODULES ) && (ima_appraise &IMA_APPRAISE_ENFORCE ))return -EACCES ;/* INTEGRITY_UNKNOWN */ -#endif return 0 ;/* We rely on module signature checking */ }return 0 ;
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG
Quoted 40 lines · Mimi Zohar
Quoted 39 lines · Bruno E. O. Meneguele
Quoted 17 lines · Mimi Zohar
Quoted 16 lines · Bruno E. O. Meneguele
When the user requests
MODULE_CHECKpolicy and its kernel is compiled withCONFIG_MODULE_SIG_FORCEnot set, all modules would not load, just those loaded in initram time. One option the user would have would be set a kernel cmdline param (module.sig_enforce) to true, but the IMA module check code doesn't rely on this value, it checks justCONFIG_MODULE_SIG_FORCE.This patch solves this problem checking for the exported value of module.sig_enforce cmdline param intead of
CONFIG_MODULE_SIG_FORCE, which holds the effective value (CONFIG || param).Signed-off-by Bruno E. O. Meneguele <[email protected]>--- security/integrity/ima/ima_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)Quoted 15 lines
security/integrity/ima/ima_main.c void ima_post_path_mknod(struct dentry *dentry) · line 361
Quoted 11 lines
security/integrity/ima/ima_main.c +2
-0@@ -356,12 +356,12 @@ void ima_post_path_mknod(struct dentry *dentry)*/ int ima_read_file (struct file *file,enum kernel_read_file_id read_id) { +bool sig_enforce =is_module_sig_enforced (); +if (!file && read_id ==READING_MODULE ) {The only reason for getting here is that you're using the old module load syscall. Is there a reason for not using the new one, which passes the file descriptor?
Basicaly because the way kmod handles compressed (gz/xz) modules. The way it's today would require major changes in the code or some kind of
memfd_create()+ xattrs reassignement in order tofinit_module()be used correctly.
Quoted 10 lines
Quoted 6 lines
Considering it would take some time to be accepted or even to figure out the correct way to tackle it, the current IMA module check code works aside kernel module signature validation, which is fine for now for me, but has the problem that this patch tries to solve in the
CONFIG_MODULE_SIG_FORCEcheck (ignoring module.sig_enforce cmdline param).Thank you for the reasoning. BTW, these patches are now queued.
You're welcome. Thank you for the feedback.
Quoted 13 lines
Quoted 12 lines
Quoted 11 lines
Quoted 9 lines
security/integrity/ima/ima_main.c +1
-3-#ifndef CONFIG_MODULE_SIG_FORCE -if ((ima_appraise &IMA_APPRAISE_MODULES ) && +if (!sig_enforce && (ima_appraise &IMA_APPRAISE_MODULES ) && (ima_appraise &IMA_APPRAISE_ENFORCE ))return -EACCES ;/* INTEGRITY_UNKNOWN */ -#endif return 0 ;/* We rely on module signature checking */ }return 0 ;
Signature · 6 lines
bmeneg
PGP Key: http://bmeneg.com/pubkey.txt
[ Part 2, Application/PGP-SIGNATURE (Name: "signature.asc") 499 bytes. ]
[ Unable to print this part. ]