From: Paul Moore <paul@paul-moore.com>
To: Fan Wu <wufan@linux.microsoft.com>,
corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org,
serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org,
axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org,
eparis@redhat.com
Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org, fsverity@lists.linux.dev,
linux-block@vger.kernel.org, dm-devel@lists.linux.dev,
audit@vger.kernel.org, linux-kernel@vger.kernel.org,
Fan Wu <wufan@linux.microsoft.com>
Subject: Re: [PATCH RFC v15 12/21] security: add security_bdev_setintegrity() hook
Date: Tue, 19 Mar 2024 19:00:36 -0400 [thread overview]
Message-ID: <f5cf9d285bd5f09bbc3f79b0800d37fc@paul-moore.com> (raw)
In-Reply-To: <1710560151-28904-13-git-send-email-wufan@linux.microsoft.com>
On Mar 15, 2024 Fan Wu <wufan@linux.microsoft.com> wrote:
>
> This patch introduces a new hook to save block device's integrity
> data. For example, for dm-verity, LSMs can use this hook to save
> the roothash signature of a dm-verity into the security blob,
> and LSMs can make access decisions based on the data inside
> the signature, like the signer certificate.
>
> Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
>
> --
> v1-v14:
> + Not present
>
> v15:
> + Introduced
>
> ---
> include/linux/lsm_hook_defs.h | 2 ++
> include/linux/security.h | 14 ++++++++++++++
> security/security.c | 28 ++++++++++++++++++++++++++++
> 3 files changed, 44 insertions(+)
I'm not sure why you made this a separate patch, help? If there is
no significant reason why this is separate, please squash it together
with patch 11/21.
> diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> index c335404470dc..6808ae763913 100644
> --- a/include/linux/lsm_hook_defs.h
> +++ b/include/linux/lsm_hook_defs.h
> @@ -455,4 +455,6 @@ LSM_HOOK(void, LSM_RET_VOID, initramfs_populated, void)
>
> LSM_HOOK(int, 0, bdev_alloc_security, struct block_device *bdev)
> LSM_HOOK(void, LSM_RET_VOID, bdev_free_security, struct block_device *bdev)
> +LSM_HOOK(int, 0, bdev_setintegrity, struct block_device *bdev,
> + enum lsm_intgr_type type, const void *value, size_t size)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 9965b5c50df4..eaff8868766a 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -83,6 +83,10 @@ enum lsm_event {
> LSM_POLICY_CHANGE,
> };
>
> +enum lsm_intgr_type {
> + __LSM_INTGR_MAX
> +};
> +
> /*
> * These are reasons that can be passed to the security_locked_down()
> * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
> @@ -511,6 +515,9 @@ int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
> void *val, size_t val_len, u64 id, u64 flags);
> int security_bdev_alloc(struct block_device *bdev);
> void security_bdev_free(struct block_device *bdev);
> +int security_bdev_setintegrity(struct block_device *bdev,
> + enum lsm_intgr_type type, const void *value,
> + size_t size);
> #else /* CONFIG_SECURITY */
>
> static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
> @@ -1495,6 +1502,13 @@ static inline void security_bdev_free(struct block_device *bdev)
> {
> }
>
> +static inline int security_bdev_setintegrity(struct block_device *bdev,
> + enum lsm_intgr_type, type,
> + const void *value, size_t size)
> +{
> + return 0;
> +}
> +
> #endif /* CONFIG_SECURITY */
>
> #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
> diff --git a/security/security.c b/security/security.c
> index 4274bbee40d0..8d88529ac904 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -5637,6 +5637,34 @@ void security_bdev_free(struct block_device *bdev)
> }
> EXPORT_SYMBOL(security_bdev_free);
>
> +/**
> + * security_bdev_setintegrity() - Set the bdev's integrity data
Let's just say "Set the device's integrity data" and not ask people to
figure out "bdev", although I will admit it should be fairly obvious :)
> + * @bdev: block device
> + * @type: type of integrity, e.g. hash digest, signature, etc
> + * @value: the integrity value
> + * @size: size of the integrity value
> + *
> + * Register a verified integrity measurement of a bdev with the LSM.
> + *
> + * Return: Returns 0 on success, negative values on failure.
> + */
> +int security_bdev_setintegrity(struct block_device *bdev,
> + enum lsm_intgr_type type, const void *value,
> + size_t size)
> +{
> + int rc = 0;
> + struct security_hook_list *p;
> +
> + hlist_for_each_entry(p, &security_hook_heads.bdev_setintegrity, list) {
> + rc = p->hook.bdev_setintegrity(bdev, type, value, size);
> + if (rc)
> + return rc;
> + }
> +
> + return LSM_RET_DEFAULT(bdev_setintegrity);
We can just use the call_int_hook() macro here instead of open coding
everything, right?
> +}
> +EXPORT_SYMBOL(security_bdev_setintegrity);
> +
> #ifdef CONFIG_PERF_EVENTS
> /**
> * security_perf_event_open() - Check if a perf event open is allowed
> --
> 2.44.0
--
paul-moore.com
next prev parent reply other threads:[~2024-03-19 23:00 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-16 3:35 [RFC PATCH v15 00/21] Integrity Policy Enforcement LSM (IPE) Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 01/21] security: add ipe lsm Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 02/21] ipe: add policy parser Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 03/21] ipe: add evaluation loop Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 04/21] ipe: add LSM hooks on execution and kernel read Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 05/21] initramfs|security: Add a security hook to do_populate_rootfs() Fan Wu
2024-03-18 0:29 ` Casey Schaufler
2024-03-18 1:58 ` Paul Moore
2024-03-16 3:35 ` [RFC PATCH v15 06/21] ipe: introduce 'boot_verified' as a trust provider Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 07/21] security: add new securityfs delete function Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 08/21] ipe: add userspace interface Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 09/21] uapi|audit|ipe: add ipe auditing support Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 10/21] ipe: add permissive toggle Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 11/21] block|security: add LSM blob to block_device Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 12/21] security: add security_bdev_setintegrity() hook Fan Wu
2024-03-19 23:00 ` Paul Moore [this message]
2024-03-20 8:28 ` [PATCH RFC " Jarkko Sakkinen
2024-03-20 8:31 ` Jarkko Sakkinen
2024-03-20 20:31 ` Fan Wu
2024-03-21 17:25 ` Jarkko Sakkinen
2024-03-16 3:35 ` [RFC PATCH v15 13/21] dm: add finalize hook to target_type Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 14/21] dm verity: consume root hash digest and signature data via LSM hook Fan Wu
2024-03-19 23:00 ` [PATCH RFC " Paul Moore
2024-03-20 2:19 ` Mike Snitzer
2024-03-20 17:23 ` Paul Moore
2024-03-20 18:49 ` Mike Snitzer
2024-03-20 17:56 ` Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 15/21] ipe: add support for dm-verity as a trust provider Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 16/21] security: add security_inode_setintegrity() hook Fan Wu
2024-03-19 23:00 ` [PATCH RFC " Paul Moore
2024-03-16 3:35 ` [RFC PATCH v15 17/21] fsverity: consume builtin signature via LSM hook Fan Wu
2024-03-18 5:29 ` Eric Biggers
2024-03-19 23:00 ` Paul Moore
2024-03-16 3:35 ` [RFC PATCH v15 18/21] ipe: enable support for fs-verity as a trust provider Fan Wu
2024-03-18 5:17 ` Eric Biggers
2024-03-18 8:08 ` Roberto Sassu
2024-03-18 20:58 ` Fan Wu
2024-03-18 20:40 ` Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 19/21] scripts: add boot policy generation program Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 20/21] ipe: kunit test for parser Fan Wu
2024-03-16 3:35 ` [RFC PATCH v15 21/21] documentation: add ipe documentation Fan Wu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f5cf9d285bd5f09bbc3f79b0800d37fc@paul-moore.com \
--to=paul@paul-moore.com \
--cc=agk@redhat.com \
--cc=audit@vger.kernel.org \
--cc=axboe@kernel.dk \
--cc=corbet@lwn.net \
--cc=dm-devel@lists.linux.dev \
--cc=ebiggers@kernel.org \
--cc=eparis@redhat.com \
--cc=fsverity@lists.linux.dev \
--cc=jmorris@namei.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=snitzer@kernel.org \
--cc=tytso@mit.edu \
--cc=wufan@linux.microsoft.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).