* [PATCH v11 1/4] security: Allow all LSMs to provide xattrs for inode_init_security hook
2023-06-03 19:15 [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
@ 2023-06-03 19:15 ` Roberto Sassu
2023-06-09 20:02 ` Paul Moore
2023-06-03 19:15 ` [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security() Roberto Sassu
` (4 subsequent siblings)
5 siblings, 1 reply; 17+ messages in thread
From: Roberto Sassu @ 2023-06-03 19:15 UTC (permalink / raw)
To: zohar, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
From: Roberto Sassu <roberto.sassu@huawei.com>
Currently, the LSM infrastructure supports only one LSM providing an xattr
and EVM calculating the HMAC on that xattr, plus other inode metadata.
Allow all LSMs to provide one or multiple xattrs, by extending the security
blob reservation mechanism. Introduce the new lbs_xattr_count field of the
lsm_blob_sizes structure, so that each LSM can specify how many xattrs it
needs, and the LSM infrastructure knows how many xattr slots it should
allocate.
Modify the inode_init_security hook definition, by passing the full
xattr array allocated in security_inode_init_security(), and the current
number of xattr slots in that array filled by LSMs. The first parameter
would allow EVM to access and calculate the HMAC on xattrs supplied by
other LSMs, the second to not leave gaps in the xattr array, when an LSM
requested but did not provide xattrs (e.g. if it is not initialized).
Introduce lsm_get_xattr_slot(), which LSMs can call as many times as the
number specified in the lbs_xattr_count field of the lsm_blob_sizes
structure. During each call, lsm_get_xattr_slot() increments the number of
filled xattrs, so that at the next invocation it returns the next xattr
slot to fill.
Cleanup security_inode_init_security(). Unify the !initxattrs and
initxattrs case by simply not allocating the new_xattrs array in the
former. Update the documentation to reflect the changes, and fix the
description of the xattr name, as it is not allocated anymore.
Adapt both SELinux and Smack to use the new definition of the
inode_init_security hook, and to call lsm_get_xattr_slot() to obtain and
fill the reserved slots in the xattr array.
Move the xattr->name assignment after the xattr->value one, so that it is
done only in case of successful memory allocation.
Finally, change the default return value of the inode_init_security hook
from zero to -EOPNOTSUPP, so that BPF LSM correctly follows the hook
conventions.
Reported-by: Nicolas Bouchinet <nicolas.bouchinet@clip-os.org> (EVM crash)
Link: https://lore.kernel.org/linux-integrity/Y1FTSIo+1x+4X0LS@archlinux/
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
include/linux/lsm_hook_defs.h | 6 +--
include/linux/lsm_hooks.h | 20 ++++++++++
security/security.c | 71 +++++++++++++++++++++++------------
security/selinux/hooks.c | 17 +++++----
security/smack/smack_lsm.c | 25 ++++++------
5 files changed, 92 insertions(+), 47 deletions(-)
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 6bb55e61e8e..a1896f90089 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -111,9 +111,9 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask,
unsigned int obj_type)
LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)
LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)
-LSM_HOOK(int, 0, inode_init_security, struct inode *inode,
- struct inode *dir, const struct qstr *qstr, const char **name,
- void **value, size_t *len)
+LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,
+ struct inode *dir, const struct qstr *qstr, struct xattr *xattrs,
+ int *xattr_count)
LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
const struct qstr *name, const struct inode *context_inode)
LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index ab2b2fafa4a..069ac73a84b 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -28,6 +28,7 @@
#include <linux/security.h>
#include <linux/init.h>
#include <linux/rculist.h>
+#include <linux/xattr.h>
union security_list_options {
#define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
@@ -63,8 +64,27 @@ struct lsm_blob_sizes {
int lbs_ipc;
int lbs_msg_msg;
int lbs_task;
+ int lbs_xattr_count; /* number of xattr slots in new_xattrs array */
};
+/**
+ * lsm_get_xattr_slot - Return the next available slot and increment the index
+ * @xattrs: array storing LSM-provided xattrs
+ * @xattr_count: number of already stored xattrs (updated)
+ *
+ * Retrieve the first available slot in the @xattrs array to fill with an xattr,
+ * and increment @xattr_count.
+ *
+ * Return: The slot to fill in @xattrs if non-NULL, NULL otherwise.
+ */
+static inline struct xattr *lsm_get_xattr_slot(struct xattr *xattrs,
+ int *xattr_count)
+{
+ if (unlikely(!xattrs))
+ return NULL;
+ return xattrs + (*xattr_count)++;
+}
+
/*
* LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void
* LSM hooks (in include/linux/lsm_hook_defs.h).
diff --git a/security/security.c b/security/security.c
index d5ff7ff45b7..bee45009581 100644
--- a/security/security.c
+++ b/security/security.c
@@ -31,8 +31,6 @@
#include <linux/msg.h>
#include <net/flow.h>
-#define MAX_LSM_EVM_XATTR 2
-
/* How many LSMs were built into the kernel? */
#define LSM_COUNT (__end_lsm_info - __start_lsm_info)
@@ -212,6 +210,8 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
+ lsm_set_blob_size(&needed->lbs_xattr_count,
+ &blob_sizes.lbs_xattr_count);
}
/* Prepare LSM for initialization. */
@@ -378,6 +378,7 @@ static void __init ordered_lsm_init(void)
init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);
init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
init_debug("task blob size = %d\n", blob_sizes.lbs_task);
+ init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count);
/*
* Create any kmem_caches needed for blobs
@@ -1591,11 +1592,15 @@ EXPORT_SYMBOL(security_dentry_create_files_as);
* created inode and set up the incore security field for the new inode. This
* hook is called by the fs code as part of the inode creation transaction and
* provides for atomic labeling of the inode, unlike the post_create/mkdir/...
- * hooks called by the VFS. The hook function is expected to allocate the name
- * and value via kmalloc, with the caller being responsible for calling kfree
- * after using them. If the security module does not use security attributes
- * or does not wish to put a security attribute on this particular inode, then
- * it should return -EOPNOTSUPP to skip this processing.
+ * hooks called by the VFS. The hook function is expected to populate the
+ * @xattrs array, by calling lsm_get_xattr_slot() to retrieve the slots
+ * reserved by the security module with the lbs_xattr_count field of the
+ * lsm_blob_sizes structure. For each slot, the hook function should set ->name
+ * to the attribute name suffix (e.g. selinux), to allocate ->value (will be
+ * freed by the caller) and set it to the attribute value, to set ->value_len to
+ * the length of the value. If the security module does not use security
+ * attributes or does not wish to put a security attribute on this particular
+ * inode, then it should return -EOPNOTSUPP to skip this processing.
*
* Return: Returns 0 on success, -EOPNOTSUPP if no security attribute is
* needed, or -ENOMEM on memory allocation failure.
@@ -1604,33 +1609,51 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
const struct qstr *qstr,
const initxattrs initxattrs, void *fs_data)
{
- struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
- struct xattr *lsm_xattr, *evm_xattr, *xattr;
- int ret;
+ struct security_hook_list *P;
+ struct xattr *new_xattrs = NULL;
+ int ret = -EOPNOTSUPP, xattr_count = 0;
if (unlikely(IS_PRIVATE(inode)))
return 0;
- if (!initxattrs)
- return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
- dir, qstr, NULL, NULL, NULL);
- memset(new_xattrs, 0, sizeof(new_xattrs));
- lsm_xattr = new_xattrs;
- ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
- &lsm_xattr->name,
- &lsm_xattr->value,
- &lsm_xattr->value_len);
- if (ret)
+ if (!blob_sizes.lbs_xattr_count)
+ return 0;
+
+ if (initxattrs) {
+ /* Allocate +1 for EVM and +1 as terminator. */
+ new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,
+ sizeof(*new_xattrs), GFP_NOFS);
+ if (!new_xattrs)
+ return -ENOMEM;
+ }
+
+ hlist_for_each_entry(P, &security_hook_heads.inode_init_security,
+ list) {
+ ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs,
+ &xattr_count);
+ if (ret && ret != -EOPNOTSUPP)
+ goto out;
+ /*
+ * As documented in lsm_hooks.h, -EOPNOTSUPP in this context
+ * means that the LSM is not willing to provide an xattr, not
+ * that it wants to signal an error. Thus, continue to invoke
+ * the remaining LSMs.
+ */
+ }
+
+ /* If initxattrs() is NULL, xattr_count is zero, skip the call. */
+ if (!xattr_count)
goto out;
- evm_xattr = lsm_xattr + 1;
- ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
+ ret = evm_inode_init_security(inode, new_xattrs,
+ &new_xattrs[xattr_count]);
if (ret)
goto out;
ret = initxattrs(inode, new_xattrs, fs_data);
out:
- for (xattr = new_xattrs; xattr->value != NULL; xattr++)
- kfree(xattr->value);
+ for (; xattr_count > 0; xattr_count--)
+ kfree(new_xattrs[xattr_count - 1].value);
+ kfree(new_xattrs);
return (ret == -EOPNOTSUPP) ? 0 : ret;
}
EXPORT_SYMBOL(security_inode_init_security);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 79b4890e993..1d9fe7cdd01 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -104,6 +104,8 @@
#include "audit.h"
#include "avc_ss.h"
+#define SELINUX_INODE_INIT_XATTRS 1
+
struct selinux_state selinux_state;
/* SECMARK reference count */
@@ -2823,11 +2825,11 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
const struct qstr *qstr,
- const char **name,
- void **value, size_t *len)
+ struct xattr *xattrs, int *xattr_count)
{
const struct task_security_struct *tsec = selinux_cred(current_cred());
struct superblock_security_struct *sbsec;
+ struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
u32 newsid, clen;
int rc;
char *context;
@@ -2854,16 +2856,14 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
!(sbsec->flags & SBLABEL_MNT))
return -EOPNOTSUPP;
- if (name)
- *name = XATTR_SELINUX_SUFFIX;
-
- if (value && len) {
+ if (xattr) {
rc = security_sid_to_context_force(newsid,
&context, &clen);
if (rc)
return rc;
- *value = context;
- *len = clen;
+ xattr->value = context;
+ xattr->value_len = clen;
+ xattr->name = XATTR_SELINUX_SUFFIX;
}
return 0;
@@ -6776,6 +6776,7 @@ struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = {
.lbs_ipc = sizeof(struct ipc_security_struct),
.lbs_msg_msg = sizeof(struct msg_security_struct),
.lbs_superblock = sizeof(struct superblock_security_struct),
+ .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
};
#ifdef CONFIG_PERF_EVENTS
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 6e270cf3fd3..a1c30275692 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -52,6 +52,8 @@
#define SMK_RECEIVING 1
#define SMK_SENDING 2
+#define SMACK_INODE_INIT_XATTRS 1
+
#ifdef SMACK_IPV6_PORT_LABELING
static DEFINE_MUTEX(smack_ipv6_lock);
static LIST_HEAD(smk_ipv6_port_list);
@@ -923,27 +925,24 @@ static int smack_inode_alloc_security(struct inode *inode)
* @inode: the newly created inode
* @dir: containing directory object
* @qstr: unused
- * @name: where to put the attribute name
- * @value: where to put the attribute value
- * @len: where to put the length of the attribute
+ * @xattrs: where to put the attributes
+ * @xattr_count: current number of LSM-provided xattrs (updated)
*
* Returns 0 if it all works out, -ENOMEM if there's no memory
*/
static int smack_inode_init_security(struct inode *inode, struct inode *dir,
- const struct qstr *qstr, const char **name,
- void **value, size_t *len)
+ const struct qstr *qstr,
+ struct xattr *xattrs, int *xattr_count)
{
struct task_smack *tsp = smack_cred(current_cred());
struct inode_smack *issp = smack_inode(inode);
struct smack_known *skp = smk_of_task(tsp);
struct smack_known *isp = smk_of_inode(inode);
struct smack_known *dsp = smk_of_inode(dir);
+ struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
int may;
- if (name)
- *name = XATTR_SMACK_SUFFIX;
-
- if (value && len) {
+ if (xattr) {
/*
* If equal, transmuting already occurred in
* smack_dentry_create_files_as(). No need to check again.
@@ -975,11 +974,12 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
issp->smk_flags |= SMK_INODE_CHANGED;
}
- *value = kstrdup(isp->smk_known, GFP_NOFS);
- if (*value == NULL)
+ xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
+ if (xattr->value == NULL)
return -ENOMEM;
- *len = strlen(isp->smk_known);
+ xattr->value_len = strlen(isp->smk_known);
+ xattr->name = XATTR_SMACK_SUFFIX;
}
return 0;
@@ -4869,6 +4869,7 @@ struct lsm_blob_sizes smack_blob_sizes __ro_after_init = {
.lbs_ipc = sizeof(struct smack_known *),
.lbs_msg_msg = sizeof(struct smack_known *),
.lbs_superblock = sizeof(struct superblock_smack),
+ .lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
};
static struct security_hook_list smack_hooks[] __ro_after_init = {
--
2.25.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [PATCH v11 1/4] security: Allow all LSMs to provide xattrs for inode_init_security hook
2023-06-03 19:15 ` [PATCH v11 1/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
@ 2023-06-09 20:02 ` Paul Moore
0 siblings, 0 replies; 17+ messages in thread
From: Paul Moore @ 2023-06-09 20:02 UTC (permalink / raw)
To: Roberto Sassu
Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
eparis, casey, linux-kernel, linux-integrity,
linux-security-module, selinux, bpf, kpsingh, keescook,
nicolas.bouchinet, Roberto Sassu
On Sat, Jun 3, 2023 at 3:16 PM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Currently, the LSM infrastructure supports only one LSM providing an xattr
> and EVM calculating the HMAC on that xattr, plus other inode metadata.
>
> Allow all LSMs to provide one or multiple xattrs, by extending the security
> blob reservation mechanism. Introduce the new lbs_xattr_count field of the
> lsm_blob_sizes structure, so that each LSM can specify how many xattrs it
> needs, and the LSM infrastructure knows how many xattr slots it should
> allocate.
>
> Modify the inode_init_security hook definition, by passing the full
> xattr array allocated in security_inode_init_security(), and the current
> number of xattr slots in that array filled by LSMs. The first parameter
> would allow EVM to access and calculate the HMAC on xattrs supplied by
> other LSMs, the second to not leave gaps in the xattr array, when an LSM
> requested but did not provide xattrs (e.g. if it is not initialized).
>
> Introduce lsm_get_xattr_slot(), which LSMs can call as many times as the
> number specified in the lbs_xattr_count field of the lsm_blob_sizes
> structure. During each call, lsm_get_xattr_slot() increments the number of
> filled xattrs, so that at the next invocation it returns the next xattr
> slot to fill.
>
> Cleanup security_inode_init_security(). Unify the !initxattrs and
> initxattrs case by simply not allocating the new_xattrs array in the
> former. Update the documentation to reflect the changes, and fix the
> description of the xattr name, as it is not allocated anymore.
>
> Adapt both SELinux and Smack to use the new definition of the
> inode_init_security hook, and to call lsm_get_xattr_slot() to obtain and
> fill the reserved slots in the xattr array.
>
> Move the xattr->name assignment after the xattr->value one, so that it is
> done only in case of successful memory allocation.
>
> Finally, change the default return value of the inode_init_security hook
> from zero to -EOPNOTSUPP, so that BPF LSM correctly follows the hook
> conventions.
>
> Reported-by: Nicolas Bouchinet <nicolas.bouchinet@clip-os.org> (EVM crash)
> Link: https://lore.kernel.org/linux-integrity/Y1FTSIo+1x+4X0LS@archlinux/
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
> include/linux/lsm_hook_defs.h | 6 +--
> include/linux/lsm_hooks.h | 20 ++++++++++
> security/security.c | 71 +++++++++++++++++++++++------------
> security/selinux/hooks.c | 17 +++++----
> security/smack/smack_lsm.c | 25 ++++++------
> 5 files changed, 92 insertions(+), 47 deletions(-)
...
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index ab2b2fafa4a..069ac73a84b 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -63,8 +64,27 @@ struct lsm_blob_sizes {
> int lbs_ipc;
> int lbs_msg_msg;
> int lbs_task;
> + int lbs_xattr_count; /* number of xattr slots in new_xattrs array */
> };
>
> +/**
> + * lsm_get_xattr_slot - Return the next available slot and increment the index
> + * @xattrs: array storing LSM-provided xattrs
> + * @xattr_count: number of already stored xattrs (updated)
> + *
> + * Retrieve the first available slot in the @xattrs array to fill with an xattr,
> + * and increment @xattr_count.
> + *
> + * Return: The slot to fill in @xattrs if non-NULL, NULL otherwise.
> + */
> +static inline struct xattr *lsm_get_xattr_slot(struct xattr *xattrs,
> + int *xattr_count)
> +{
> + if (unlikely(!xattrs))
> + return NULL;
> + return xattrs + (*xattr_count)++;
I would have tried to avoid the pointer math by writing the above like
the line below:
return &xattrs[(*xattr_count)++]
... but I wouldn't worry about that, what you have is fine; I only
mention this in case you need to respin this patchset for some other
reason.
--
paul-moore.com
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
2023-06-03 19:15 [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
2023-06-03 19:15 ` [PATCH v11 1/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
@ 2023-06-03 19:15 ` Roberto Sassu
2023-06-05 8:38 ` Roberto Sassu
2023-06-09 19:35 ` Mimi Zohar
2023-06-03 19:15 ` [PATCH v11 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
` (3 subsequent siblings)
5 siblings, 2 replies; 17+ messages in thread
From: Roberto Sassu @ 2023-06-03 19:15 UTC (permalink / raw)
To: zohar, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
From: Roberto Sassu <roberto.sassu@huawei.com>
With the newly added ability of LSMs to supply multiple xattrs, set
SMACK64TRASMUTE in smack_inode_init_security(), instead of d_instantiate().
Do it by incrementing SMACK_INODE_INIT_XATTRS to 2 and by calling
lsm_get_xattr_slot() a second time, if the transmuting conditions are met.
The LSM infrastructure passes all xattrs provided by LSMs to the
filesystems through the initxattrs() callback, so that filesystems can
store xattrs in the disk.
After the change, the SMK_INODE_TRANSMUTE inode flag is always set by
d_instantiate() after fetching SMACK64TRANSMUTE from the disk. Before it
was done by smack_inode_post_setxattr() as result of the __vfs_setxattr()
call.
Removing __vfs_setxattr() also prevents invalidating the EVM HMAC, by
adding a new xattr without checking and updating the existing HMAC.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
security/smack/smack.h | 2 +-
security/smack/smack_lsm.c | 43 +++++++++++++++++++++++---------------
2 files changed, 27 insertions(+), 18 deletions(-)
diff --git a/security/smack/smack.h b/security/smack/smack.h
index aa15ff56ed6..041688e5a77 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -128,7 +128,7 @@ struct task_smack {
#define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
#define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
-#define SMK_INODE_CHANGED 0x04 /* smack was transmuted */
+#define SMK_INODE_CHANGED 0x04 /* smack was transmuted (unused) */
#define SMK_INODE_IMPURE 0x08 /* involved in an impure transaction */
/*
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index a1c30275692..b67d901ee74 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -52,7 +52,14 @@
#define SMK_RECEIVING 1
#define SMK_SENDING 2
-#define SMACK_INODE_INIT_XATTRS 1
+/*
+ * Smack uses multiple xattrs.
+ * SMACK64 - for access control,
+ * SMACK64TRANSMUTE - label initialization,
+ * Not saved on files - SMACK64IPIN and SMACK64IPOUT,
+ * Must be set explicitly - SMACK64EXEC and SMACK64MMAP
+ */
+#define SMACK_INODE_INIT_XATTRS 2
#ifdef SMACK_IPV6_PORT_LABELING
static DEFINE_MUTEX(smack_ipv6_lock);
@@ -935,7 +942,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
struct xattr *xattrs, int *xattr_count)
{
struct task_smack *tsp = smack_cred(current_cred());
- struct inode_smack *issp = smack_inode(inode);
struct smack_known *skp = smk_of_task(tsp);
struct smack_known *isp = smk_of_inode(inode);
struct smack_known *dsp = smk_of_inode(dir);
@@ -963,6 +969,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
if ((tsp->smk_task == tsp->smk_transmuted) ||
(may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
smk_inode_transmutable(dir))) {
+ struct xattr *xattr_transmute;
+
/*
* The caller of smack_dentry_create_files_as()
* should have overridden the current cred, so the
@@ -971,7 +979,16 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
*/
if (tsp->smk_task != tsp->smk_transmuted)
isp = dsp;
- issp->smk_flags |= SMK_INODE_CHANGED;
+ xattr_transmute = lsm_get_xattr_slot(xattrs, xattr_count);
+ if (xattr_transmute) {
+ xattr_transmute->value = kmemdup(TRANS_TRUE,
+ TRANS_TRUE_SIZE, GFP_NOFS);
+ if (xattr_transmute->value == NULL)
+ return -ENOMEM;
+
+ xattr_transmute->value_len = TRANS_TRUE_SIZE;
+ xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
+ }
}
xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
@@ -3518,20 +3535,12 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
* If there is a transmute attribute on the
* directory mark the inode.
*/
- if (isp->smk_flags & SMK_INODE_CHANGED) {
- isp->smk_flags &= ~SMK_INODE_CHANGED;
- rc = __vfs_setxattr(&nop_mnt_idmap, dp, inode,
- XATTR_NAME_SMACKTRANSMUTE,
- TRANS_TRUE, TRANS_TRUE_SIZE,
- 0);
- } else {
- rc = __vfs_getxattr(dp, inode,
- XATTR_NAME_SMACKTRANSMUTE, trattr,
- TRANS_TRUE_SIZE);
- if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
- TRANS_TRUE_SIZE) != 0)
- rc = -EINVAL;
- }
+ rc = __vfs_getxattr(dp, inode,
+ XATTR_NAME_SMACKTRANSMUTE, trattr,
+ TRANS_TRUE_SIZE);
+ if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
+ TRANS_TRUE_SIZE) != 0)
+ rc = -EINVAL;
if (rc >= 0)
transflag = SMK_INODE_TRANSMUTE;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
2023-06-03 19:15 ` [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security() Roberto Sassu
@ 2023-06-05 8:38 ` Roberto Sassu
2023-06-09 7:26 ` Jarkko Sakkinen
2023-06-23 19:32 ` Mengchi Cheng
2023-06-09 19:35 ` Mimi Zohar
1 sibling, 2 replies; 17+ messages in thread
From: Roberto Sassu @ 2023-06-05 8:38 UTC (permalink / raw)
To: Mengchi Cheng
Cc: miklos, linux-unionfs, kamatam, yoonjaeh, zohar, dmitry.kasatkin,
paul, jmorris, serge, stephen.smalley.work, eparis, casey,
linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
On Sat, 2023-06-03 at 21:15 +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> With the newly added ability of LSMs to supply multiple xattrs, set
> SMACK64TRASMUTE in smack_inode_init_security(), instead of d_instantiate().
> Do it by incrementing SMACK_INODE_INIT_XATTRS to 2 and by calling
> lsm_get_xattr_slot() a second time, if the transmuting conditions are met.
>
> The LSM infrastructure passes all xattrs provided by LSMs to the
> filesystems through the initxattrs() callback, so that filesystems can
> store xattrs in the disk.
>
> After the change, the SMK_INODE_TRANSMUTE inode flag is always set by
> d_instantiate() after fetching SMACK64TRANSMUTE from the disk. Before it
> was done by smack_inode_post_setxattr() as result of the __vfs_setxattr()
> call.
>
> Removing __vfs_setxattr() also prevents invalidating the EVM HMAC, by
> adding a new xattr without checking and updating the existing HMAC.
Hi Mengchi
could you please redo your tests with this patch set applied?
https://lore.kernel.org/linux-integrity/20230603191518.1397490-1-roberto.sassu@huaweicloud.com/
You need:
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git/log/?h=next
https://github.com/cschaufler/smack-next/commits/next
Thanks
Roberto
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
> security/smack/smack.h | 2 +-
> security/smack/smack_lsm.c | 43 +++++++++++++++++++++++---------------
> 2 files changed, 27 insertions(+), 18 deletions(-)
>
> diff --git a/security/smack/smack.h b/security/smack/smack.h
> index aa15ff56ed6..041688e5a77 100644
> --- a/security/smack/smack.h
> +++ b/security/smack/smack.h
> @@ -128,7 +128,7 @@ struct task_smack {
>
> #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
> #define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
> -#define SMK_INODE_CHANGED 0x04 /* smack was transmuted */
> +#define SMK_INODE_CHANGED 0x04 /* smack was transmuted (unused) */
> #define SMK_INODE_IMPURE 0x08 /* involved in an impure transaction */
>
> /*
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index a1c30275692..b67d901ee74 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -52,7 +52,14 @@
> #define SMK_RECEIVING 1
> #define SMK_SENDING 2
>
> -#define SMACK_INODE_INIT_XATTRS 1
> +/*
> + * Smack uses multiple xattrs.
> + * SMACK64 - for access control,
> + * SMACK64TRANSMUTE - label initialization,
> + * Not saved on files - SMACK64IPIN and SMACK64IPOUT,
> + * Must be set explicitly - SMACK64EXEC and SMACK64MMAP
> + */
> +#define SMACK_INODE_INIT_XATTRS 2
>
> #ifdef SMACK_IPV6_PORT_LABELING
> static DEFINE_MUTEX(smack_ipv6_lock);
> @@ -935,7 +942,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> struct xattr *xattrs, int *xattr_count)
> {
> struct task_smack *tsp = smack_cred(current_cred());
> - struct inode_smack *issp = smack_inode(inode);
> struct smack_known *skp = smk_of_task(tsp);
> struct smack_known *isp = smk_of_inode(inode);
> struct smack_known *dsp = smk_of_inode(dir);
> @@ -963,6 +969,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> if ((tsp->smk_task == tsp->smk_transmuted) ||
> (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
> smk_inode_transmutable(dir))) {
> + struct xattr *xattr_transmute;
> +
> /*
> * The caller of smack_dentry_create_files_as()
> * should have overridden the current cred, so the
> @@ -971,7 +979,16 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> */
> if (tsp->smk_task != tsp->smk_transmuted)
> isp = dsp;
> - issp->smk_flags |= SMK_INODE_CHANGED;
> + xattr_transmute = lsm_get_xattr_slot(xattrs, xattr_count);
> + if (xattr_transmute) {
> + xattr_transmute->value = kmemdup(TRANS_TRUE,
> + TRANS_TRUE_SIZE, GFP_NOFS);
> + if (xattr_transmute->value == NULL)
> + return -ENOMEM;
> +
> + xattr_transmute->value_len = TRANS_TRUE_SIZE;
> + xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
> + }
> }
>
> xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
> @@ -3518,20 +3535,12 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
> * If there is a transmute attribute on the
> * directory mark the inode.
> */
> - if (isp->smk_flags & SMK_INODE_CHANGED) {
> - isp->smk_flags &= ~SMK_INODE_CHANGED;
> - rc = __vfs_setxattr(&nop_mnt_idmap, dp, inode,
> - XATTR_NAME_SMACKTRANSMUTE,
> - TRANS_TRUE, TRANS_TRUE_SIZE,
> - 0);
> - } else {
> - rc = __vfs_getxattr(dp, inode,
> - XATTR_NAME_SMACKTRANSMUTE, trattr,
> - TRANS_TRUE_SIZE);
> - if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
> - TRANS_TRUE_SIZE) != 0)
> - rc = -EINVAL;
> - }
> + rc = __vfs_getxattr(dp, inode,
> + XATTR_NAME_SMACKTRANSMUTE, trattr,
> + TRANS_TRUE_SIZE);
> + if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
> + TRANS_TRUE_SIZE) != 0)
> + rc = -EINVAL;
> if (rc >= 0)
> transflag = SMK_INODE_TRANSMUTE;
> }
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
2023-06-05 8:38 ` Roberto Sassu
@ 2023-06-09 7:26 ` Jarkko Sakkinen
2023-06-10 7:01 ` Roberto Sassu
2023-06-23 19:32 ` Mengchi Cheng
1 sibling, 1 reply; 17+ messages in thread
From: Jarkko Sakkinen @ 2023-06-09 7:26 UTC (permalink / raw)
To: Roberto Sassu, Mengchi Cheng
Cc: miklos, linux-unionfs, kamatam, yoonjaeh, zohar, dmitry.kasatkin,
paul, jmorris, serge, stephen.smalley.work, eparis, casey,
linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
On Mon Jun 5, 2023 at 11:38 AM EEST, Roberto Sassu wrote:
> On Sat, 2023-06-03 at 21:15 +0200, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> >
> > With the newly added ability of LSMs to supply multiple xattrs, set
> > SMACK64TRASMUTE in smack_inode_init_security(), instead of d_instantiate().
nit: TRANSMUTE
Sorry, just hit into my eye. I skimmed it because I implemented original
feature :-)
BR, Jarkko
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
2023-06-09 7:26 ` Jarkko Sakkinen
@ 2023-06-10 7:01 ` Roberto Sassu
0 siblings, 0 replies; 17+ messages in thread
From: Roberto Sassu @ 2023-06-10 7:01 UTC (permalink / raw)
To: Jarkko Sakkinen, Mengchi Cheng
Cc: miklos, linux-unionfs, kamatam, yoonjaeh, zohar, dmitry.kasatkin,
paul, jmorris, serge, stephen.smalley.work, eparis, casey,
linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
On 6/9/2023 9:26 AM, Jarkko Sakkinen wrote:
> On Mon Jun 5, 2023 at 11:38 AM EEST, Roberto Sassu wrote:
>> On Sat, 2023-06-03 at 21:15 +0200, Roberto Sassu wrote:
>>> From: Roberto Sassu <roberto.sassu@huawei.com>
>>>
>>> With the newly added ability of LSMs to supply multiple xattrs, set
>>> SMACK64TRASMUTE in smack_inode_init_security(), instead of d_instantiate().
>
> nit: TRANSMUTE
>
> Sorry, just hit into my eye. I skimmed it because I implemented original
> feature :-)
Cool!
Currently the transmute xattr is defined as:
#define XATTR_SMACK_TRANSMUTE "SMACK64TRANSMUTE"
so, should be good to say the full xattr name, right?
Thanks
Roberto
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
2023-06-05 8:38 ` Roberto Sassu
2023-06-09 7:26 ` Jarkko Sakkinen
@ 2023-06-23 19:32 ` Mengchi Cheng
1 sibling, 0 replies; 17+ messages in thread
From: Mengchi Cheng @ 2023-06-23 19:32 UTC (permalink / raw)
To: roberto.sassu
Cc: bpf, casey, dmitry.kasatkin, eparis, jmorris, kamatam, keescook,
kpsingh, linux-integrity, linux-kernel, linux-security-module,
linux-unionfs, mengcc, miklos, nicolas.bouchinet, paul,
roberto.sassu, selinux, serge, stephen.smalley.work, yoonjaeh,
zohar
On Mon, 2023-06-05 08:38:29 +0000, Roberto Sassu wrote:
>
> On Sat, 2023-06-03 at 21:15 +0200, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> >
> > With the newly added ability of LSMs to supply multiple xattrs, set
> > SMACK64TRASMUTE in smack_inode_init_security(), instead of d_instantiate().
> > Do it by incrementing SMACK_INODE_INIT_XATTRS to 2 and by calling
> > lsm_get_xattr_slot() a second time, if the transmuting conditions are met.
> >
> > The LSM infrastructure passes all xattrs provided by LSMs to the
> > filesystems through the initxattrs() callback, so that filesystems can
> > store xattrs in the disk.
> >
> > After the change, the SMK_INODE_TRANSMUTE inode flag is always set by
> > d_instantiate() after fetching SMACK64TRANSMUTE from the disk. Before it
> > was done by smack_inode_post_setxattr() as result of the __vfs_setxattr()
> > call.
> >
> > Removing __vfs_setxattr() also prevents invalidating the EVM HMAC, by
> > adding a new xattr without checking and updating the existing HMAC.
>
> Hi Mengchi
>
> could you please redo your tests with this patch set applied?
>
> https://lore.kernel.org/linux-integrity/20230603191518.1397490-1-roberto.sassu@huaweicloud.com/
>
> You need:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git/log/?h=next
>
> https://github.com/cschaufler/smack-next/commits/next
>
> Thanks
>
> Roberto
Sorry for the later reply. It turned out lsm.git repo needs your previous
two overlay fs fixes before applying these four patches.
With v12 I did not see the issue I reported anymore.
Best,
Mengchi
>
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> > security/smack/smack.h | 2 +-
> > security/smack/smack_lsm.c | 43 +++++++++++++++++++++++---------------
> > 2 files changed, 27 insertions(+), 18 deletions(-)
> >
> > diff --git a/security/smack/smack.h b/security/smack/smack.h
> > index aa15ff56ed6..041688e5a77 100644
> > --- a/security/smack/smack.h
> > +++ b/security/smack/smack.h
> > @@ -128,7 +128,7 @@ struct task_smack {
> >
> > #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
> > #define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
> > -#define SMK_INODE_CHANGED 0x04 /* smack was transmuted */
> > +#define SMK_INODE_CHANGED 0x04 /* smack was transmuted (unused) */
> > #define SMK_INODE_IMPURE 0x08 /* involved in an impure transaction */
> >
> > /*
> > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> > index a1c30275692..b67d901ee74 100644
> > --- a/security/smack/smack_lsm.c
> > +++ b/security/smack/smack_lsm.c
> > @@ -52,7 +52,14 @@
> > #define SMK_RECEIVING 1
> > #define SMK_SENDING 2
> >
> > -#define SMACK_INODE_INIT_XATTRS 1
> > +/*
> > + * Smack uses multiple xattrs.
> > + * SMACK64 - for access control,
> > + * SMACK64TRANSMUTE - label initialization,
> > + * Not saved on files - SMACK64IPIN and SMACK64IPOUT,
> > + * Must be set explicitly - SMACK64EXEC and SMACK64MMAP
> > + */
> > +#define SMACK_INODE_INIT_XATTRS 2
> >
> > #ifdef SMACK_IPV6_PORT_LABELING
> > static DEFINE_MUTEX(smack_ipv6_lock);
> > @@ -935,7 +942,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> > struct xattr *xattrs, int *xattr_count)
> > {
> > struct task_smack *tsp = smack_cred(current_cred());
> > - struct inode_smack *issp = smack_inode(inode);
> > struct smack_known *skp = smk_of_task(tsp);
> > struct smack_known *isp = smk_of_inode(inode);
> > struct smack_known *dsp = smk_of_inode(dir);
> > @@ -963,6 +969,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> > if ((tsp->smk_task == tsp->smk_transmuted) ||
> > (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
> > smk_inode_transmutable(dir))) {
> > + struct xattr *xattr_transmute;
> > +
> > /*
> > * The caller of smack_dentry_create_files_as()
> > * should have overridden the current cred, so the
> > @@ -971,7 +979,16 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> > */
> > if (tsp->smk_task != tsp->smk_transmuted)
> > isp = dsp;
> > - issp->smk_flags |= SMK_INODE_CHANGED;
> > + xattr_transmute = lsm_get_xattr_slot(xattrs, xattr_count);
> > + if (xattr_transmute) {
> > + xattr_transmute->value = kmemdup(TRANS_TRUE,
> > + TRANS_TRUE_SIZE, GFP_NOFS);
> > + if (xattr_transmute->value == NULL)
> > + return -ENOMEM;
> > +
> > + xattr_transmute->value_len = TRANS_TRUE_SIZE;
> > + xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
> > + }
> > }
> >
> > xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
> > @@ -3518,20 +3535,12 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
> > * If there is a transmute attribute on the
> > * directory mark the inode.
> > */
> > - if (isp->smk_flags & SMK_INODE_CHANGED) {
> > - isp->smk_flags &= ~SMK_INODE_CHANGED;
> > - rc = __vfs_setxattr(&nop_mnt_idmap, dp, inode,
> > - XATTR_NAME_SMACKTRANSMUTE,
> > - TRANS_TRUE, TRANS_TRUE_SIZE,
> > - 0);
> > - } else {
> > - rc = __vfs_getxattr(dp, inode,
> > - XATTR_NAME_SMACKTRANSMUTE, trattr,
> > - TRANS_TRUE_SIZE);
> > - if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
> > - TRANS_TRUE_SIZE) != 0)
> > - rc = -EINVAL;
> > - }
> > + rc = __vfs_getxattr(dp, inode,
> > + XATTR_NAME_SMACKTRANSMUTE, trattr,
> > + TRANS_TRUE_SIZE);
> > + if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
> > + TRANS_TRUE_SIZE) != 0)
> > + rc = -EINVAL;
> > if (rc >= 0)
> > transflag = SMK_INODE_TRANSMUTE;
> > }
>
>
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
2023-06-03 19:15 ` [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security() Roberto Sassu
2023-06-05 8:38 ` Roberto Sassu
@ 2023-06-09 19:35 ` Mimi Zohar
2023-06-10 7:09 ` Roberto Sassu
1 sibling, 1 reply; 17+ messages in thread
From: Mimi Zohar @ 2023-06-09 19:35 UTC (permalink / raw)
To: Roberto Sassu, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
Hi Roberto,
On Sat, 2023-06-03 at 21:15 +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> With the newly added ability of LSMs to supply multiple xattrs, set
> SMACK64TRASMUTE in smack_inode_init_security(), instead of d_instantiate().
> Do it by incrementing SMACK_INODE_INIT_XATTRS to 2 and by calling
> lsm_get_xattr_slot() a second time, if the transmuting conditions are met.
>
> The LSM infrastructure passes all xattrs provided by LSMs to the
> filesystems through the initxattrs() callback, so that filesystems can
> store xattrs in the disk.
>
> After the change, the SMK_INODE_TRANSMUTE inode flag is always set by
> d_instantiate() after fetching SMACK64TRANSMUTE from the disk. Before it
> was done by smack_inode_post_setxattr() as result of the __vfs_setxattr()
> call.
>
> Removing __vfs_setxattr() also prevents invalidating the EVM HMAC, by
> adding a new xattr without checking and updating the existing HMAC.
>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Just a few comments/nits inline.
> ---
> security/smack/smack.h | 2 +-
> security/smack/smack_lsm.c | 43 +++++++++++++++++++++++---------------
> 2 files changed, 27 insertions(+), 18 deletions(-)
>
> diff --git a/security/smack/smack.h b/security/smack/smack.h
> index aa15ff56ed6..041688e5a77 100644
> --- a/security/smack/smack.h
> +++ b/security/smack/smack.h
> @@ -128,7 +128,7 @@ struct task_smack {
>
> #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
> #define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
> -#define SMK_INODE_CHANGED 0x04 /* smack was transmuted */
> +#define SMK_INODE_CHANGED 0x04 /* smack was transmuted (unused) */
> #define SMK_INODE_IMPURE 0x08 /* involved in an impure transaction */
>
> /*
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index a1c30275692..b67d901ee74 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -52,7 +52,14 @@
> #define SMK_RECEIVING 1
> #define SMK_SENDING 2
>
> -#define SMACK_INODE_INIT_XATTRS 1
> +/*
> + * Smack uses multiple xattrs.
> + * SMACK64 - for access control,
> + * SMACK64TRANSMUTE - label initialization,
> + * Not saved on files - SMACK64IPIN and SMACK64IPOUT,
> + * Must be set explicitly - SMACK64EXEC and SMACK64MMAP
> + */
> +#define SMACK_INODE_INIT_XATTRS 2
>
> #ifdef SMACK_IPV6_PORT_LABELING
> static DEFINE_MUTEX(smack_ipv6_lock);
> @@ -935,7 +942,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> struct xattr *xattrs, int *xattr_count)
> {
> struct task_smack *tsp = smack_cred(current_cred());
> - struct inode_smack *issp = smack_inode(inode);
> struct smack_known *skp = smk_of_task(tsp);
> struct smack_known *isp = smk_of_inode(inode);
> struct smack_known *dsp = smk_of_inode(dir);
> @@ -963,6 +969,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> if ((tsp->smk_task == tsp->smk_transmuted) ||
> (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
> smk_inode_transmutable(dir))) {
> + struct xattr *xattr_transmute;
> +
Variables should be defined at the beginning of the function.
Is there a reason for beginning the function with "if (xattr) {"
instead "if (!xattr) return 0;". This causes unnecessary indenting.
> /*
> * The caller of smack_dentry_create_files_as()
> * should have overridden the current cred, so the
> @@ -971,7 +979,16 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> */
> if (tsp->smk_task != tsp->smk_transmuted)
> isp = dsp;
> - issp->smk_flags |= SMK_INODE_CHANGED;
> + xattr_transmute = lsm_get_xattr_slot(xattrs, xattr_count);
> + if (xattr_transmute) {
> + xattr_transmute->value = kmemdup(TRANS_TRUE,
> + TRANS_TRUE_SIZE, GFP_NOFS);
script/checkpatch --strict complains here.
> + if (xattr_transmute->value == NULL)
> + return -ENOMEM;
> +
> + xattr_transmute->value_len = TRANS_TRUE_SIZE;
> + xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
> + }
> }
>
> xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
> @@ -3518,20 +3535,12 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
> * If there is a transmute attribute on the
> * directory mark the inode.
> */
> - if (isp->smk_flags & SMK_INODE_CHANGED) {
> - isp->smk_flags &= ~SMK_INODE_CHANGED;
> - rc = __vfs_setxattr(&nop_mnt_idmap, dp, inode,
> - XATTR_NAME_SMACKTRANSMUTE,
> - TRANS_TRUE, TRANS_TRUE_SIZE,
> - 0);
> - } else {
> - rc = __vfs_getxattr(dp, inode,
> - XATTR_NAME_SMACKTRANSMUTE, trattr,
> - TRANS_TRUE_SIZE);
> - if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
> - TRANS_TRUE_SIZE) != 0)
> - rc = -EINVAL;
> - }
> + rc = __vfs_getxattr(dp, inode,
> + XATTR_NAME_SMACKTRANSMUTE, trattr,
> + TRANS_TRUE_SIZE);
> + if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
> + TRANS_TRUE_SIZE) != 0)
> + rc = -EINVAL;
> if (rc >= 0)
> transflag = SMK_INODE_TRANSMUTE;
> }
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
2023-06-09 19:35 ` Mimi Zohar
@ 2023-06-10 7:09 ` Roberto Sassu
0 siblings, 0 replies; 17+ messages in thread
From: Roberto Sassu @ 2023-06-10 7:09 UTC (permalink / raw)
To: Mimi Zohar, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
On 6/9/2023 9:35 PM, Mimi Zohar wrote:
> Hi Roberto,
>
> On Sat, 2023-06-03 at 21:15 +0200, Roberto Sassu wrote:
>> From: Roberto Sassu <roberto.sassu@huawei.com>
>>
>> With the newly added ability of LSMs to supply multiple xattrs, set
>> SMACK64TRASMUTE in smack_inode_init_security(), instead of d_instantiate().
>> Do it by incrementing SMACK_INODE_INIT_XATTRS to 2 and by calling
>> lsm_get_xattr_slot() a second time, if the transmuting conditions are met.
>>
>> The LSM infrastructure passes all xattrs provided by LSMs to the
>> filesystems through the initxattrs() callback, so that filesystems can
>> store xattrs in the disk.
>>
>> After the change, the SMK_INODE_TRANSMUTE inode flag is always set by
>> d_instantiate() after fetching SMACK64TRANSMUTE from the disk. Before it
>> was done by smack_inode_post_setxattr() as result of the __vfs_setxattr()
>> call.
>>
>> Removing __vfs_setxattr() also prevents invalidating the EVM HMAC, by
>> adding a new xattr without checking and updating the existing HMAC.
>>
>> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
>
> Just a few comments/nits inline.
>
>> ---
>> security/smack/smack.h | 2 +-
>> security/smack/smack_lsm.c | 43 +++++++++++++++++++++++---------------
>> 2 files changed, 27 insertions(+), 18 deletions(-)
>>
>> diff --git a/security/smack/smack.h b/security/smack/smack.h
>> index aa15ff56ed6..041688e5a77 100644
>> --- a/security/smack/smack.h
>> +++ b/security/smack/smack.h
>> @@ -128,7 +128,7 @@ struct task_smack {
>>
>> #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
>> #define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
>> -#define SMK_INODE_CHANGED 0x04 /* smack was transmuted */
>> +#define SMK_INODE_CHANGED 0x04 /* smack was transmuted (unused) */
>> #define SMK_INODE_IMPURE 0x08 /* involved in an impure transaction */
>>
>> /*
>> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
>> index a1c30275692..b67d901ee74 100644
>> --- a/security/smack/smack_lsm.c
>> +++ b/security/smack/smack_lsm.c
>> @@ -52,7 +52,14 @@
>> #define SMK_RECEIVING 1
>> #define SMK_SENDING 2
>>
>> -#define SMACK_INODE_INIT_XATTRS 1
>> +/*
>> + * Smack uses multiple xattrs.
>> + * SMACK64 - for access control,
>> + * SMACK64TRANSMUTE - label initialization,
>> + * Not saved on files - SMACK64IPIN and SMACK64IPOUT,
>> + * Must be set explicitly - SMACK64EXEC and SMACK64MMAP
>> + */
>> +#define SMACK_INODE_INIT_XATTRS 2
>>
>> #ifdef SMACK_IPV6_PORT_LABELING
>> static DEFINE_MUTEX(smack_ipv6_lock);
>> @@ -935,7 +942,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>> struct xattr *xattrs, int *xattr_count)
>> {
>> struct task_smack *tsp = smack_cred(current_cred());
>> - struct inode_smack *issp = smack_inode(inode);
>> struct smack_known *skp = smk_of_task(tsp);
>> struct smack_known *isp = smk_of_inode(inode);
>> struct smack_known *dsp = smk_of_inode(dir);
>> @@ -963,6 +969,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>> if ((tsp->smk_task == tsp->smk_transmuted) ||
>> (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
>> smk_inode_transmutable(dir))) {
>> + struct xattr *xattr_transmute;
>> +
>
> Variables should be defined at the beginning of the function.
Casey asked to declare the variable in this block.
> Is there a reason for beginning the function with "if (xattr) {"
> instead "if (!xattr) return 0;". This causes unnecessary indenting.
I revisited this part and made few fixes:
https://lore.kernel.org/linux-security-module/20230607123612.2791303-1-roberto.sassu@huaweicloud.com/
Patch 3 should address your concern.
>> /*
>> * The caller of smack_dentry_create_files_as()
>> * should have overridden the current cred, so the
>> @@ -971,7 +979,16 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>> */
>> if (tsp->smk_task != tsp->smk_transmuted)
>> isp = dsp;
>> - issp->smk_flags |= SMK_INODE_CHANGED;
>> + xattr_transmute = lsm_get_xattr_slot(xattrs, xattr_count);
>> + if (xattr_transmute) {
>> + xattr_transmute->value = kmemdup(TRANS_TRUE,
>> + TRANS_TRUE_SIZE, GFP_NOFS);
>
> script/checkpatch --strict complains here.
Thanks, I didn't know about it.
It seems that they are more stylistic things. Probably, not worth to
respin the patch set just for those (unless you prefer I do it).
Thanks
Roberto
>> + if (xattr_transmute->value == NULL)
>> + return -ENOMEM;
>> +
>> + xattr_transmute->value_len = TRANS_TRUE_SIZE;
>> + xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
>> + }
>> }
>>
>> xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
>> @@ -3518,20 +3535,12 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
>> * If there is a transmute attribute on the
>> * directory mark the inode.
>> */
>> - if (isp->smk_flags & SMK_INODE_CHANGED) {
>> - isp->smk_flags &= ~SMK_INODE_CHANGED;
>> - rc = __vfs_setxattr(&nop_mnt_idmap, dp, inode,
>> - XATTR_NAME_SMACKTRANSMUTE,
>> - TRANS_TRUE, TRANS_TRUE_SIZE,
>> - 0);
>> - } else {
>> - rc = __vfs_getxattr(dp, inode,
>> - XATTR_NAME_SMACKTRANSMUTE, trattr,
>> - TRANS_TRUE_SIZE);
>> - if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
>> - TRANS_TRUE_SIZE) != 0)
>> - rc = -EINVAL;
>> - }
>> + rc = __vfs_getxattr(dp, inode,
>> + XATTR_NAME_SMACKTRANSMUTE, trattr,
>> + TRANS_TRUE_SIZE);
>> + if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
>> + TRANS_TRUE_SIZE) != 0)
>> + rc = -EINVAL;
>> if (rc >= 0)
>> transflag = SMK_INODE_TRANSMUTE;
>> }
>
>
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH v11 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure
2023-06-03 19:15 [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
2023-06-03 19:15 ` [PATCH v11 1/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
2023-06-03 19:15 ` [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security() Roberto Sassu
@ 2023-06-03 19:15 ` Roberto Sassu
2023-06-09 19:48 ` Mimi Zohar
2023-06-03 19:15 ` [PATCH v11 4/4] evm: Support multiple LSMs providing an xattr Roberto Sassu
` (2 subsequent siblings)
5 siblings, 1 reply; 17+ messages in thread
From: Roberto Sassu @ 2023-06-03 19:15 UTC (permalink / raw)
To: zohar, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
From: Roberto Sassu <roberto.sassu@huawei.com>
Change the evm_inode_init_security() definition to align with the LSM
infrastructure. Keep the existing behavior of including in the HMAC
calculation only the first xattr provided by LSMs.
Changing the evm_inode_init_security() definition requires passing the
xattr array allocated by security_inode_init_security(), and the number of
xattrs filled by previously invoked LSMs.
Use the newly introduced lsm_get_xattr_slot() to position EVM correctly in
the xattrs array, like a regular LSM, and to increment the number of filled
slots. For now, the LSM infrastructure allocates enough xattrs slots to
store the EVM xattr, without using the reservation mechanism.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
include/linux/evm.h | 13 +++++++------
security/integrity/evm/evm_main.c | 16 ++++++++++------
security/security.c | 4 ++--
3 files changed, 19 insertions(+), 14 deletions(-)
diff --git a/include/linux/evm.h b/include/linux/evm.h
index 7dc1ee74169..597632c71c7 100644
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -56,9 +56,9 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
{
return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
}
-extern int evm_inode_init_security(struct inode *inode,
- const struct xattr *xattr_array,
- struct xattr *evm);
+extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
+ const struct qstr *qstr,
+ struct xattr *xattrs, int *xattr_count);
extern bool evm_revalidate_status(const char *xattr_name);
extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);
extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
@@ -157,9 +157,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry,
return;
}
-static inline int evm_inode_init_security(struct inode *inode,
- const struct xattr *xattr_array,
- struct xattr *evm)
+static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
+ const struct qstr *qstr,
+ struct xattr *xattrs,
+ int *xattr_count)
{
return 0;
}
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index cf24c525558..475196ce712 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -21,6 +21,7 @@
#include <linux/evm.h>
#include <linux/magic.h>
#include <linux/posix_acl_xattr.h>
+#include <linux/lsm_hooks.h>
#include <crypto/hash.h>
#include <crypto/hash_info.h>
@@ -864,23 +865,26 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
/*
* evm_inode_init_security - initializes security.evm HMAC value
*/
-int evm_inode_init_security(struct inode *inode,
- const struct xattr *lsm_xattr,
- struct xattr *evm_xattr)
+int evm_inode_init_security(struct inode *inode, struct inode *dir,
+ const struct qstr *qstr, struct xattr *xattrs,
+ int *xattr_count)
{
struct evm_xattr *xattr_data;
+ struct xattr *evm_xattr;
int rc;
- if (!(evm_initialized & EVM_INIT_HMAC) ||
- !evm_protected_xattr(lsm_xattr->name))
+ if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
+ !evm_protected_xattr(xattrs->name))
return 0;
+ evm_xattr = lsm_get_xattr_slot(xattrs, xattr_count);
+
xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
if (!xattr_data)
return -ENOMEM;
xattr_data->data.type = EVM_XATTR_HMAC;
- rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
+ rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
if (rc < 0)
goto out;
diff --git a/security/security.c b/security/security.c
index bee45009581..3962bd14012 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1645,8 +1645,8 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
if (!xattr_count)
goto out;
- ret = evm_inode_init_security(inode, new_xattrs,
- &new_xattrs[xattr_count]);
+ ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
+ &xattr_count);
if (ret)
goto out;
ret = initxattrs(inode, new_xattrs, fs_data);
--
2.25.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [PATCH v11 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure
2023-06-03 19:15 ` [PATCH v11 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
@ 2023-06-09 19:48 ` Mimi Zohar
0 siblings, 0 replies; 17+ messages in thread
From: Mimi Zohar @ 2023-06-09 19:48 UTC (permalink / raw)
To: Roberto Sassu, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
On Sat, 2023-06-03 at 21:15 +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Change the evm_inode_init_security() definition to align with the LSM
> infrastructure. Keep the existing behavior of including in the HMAC
> calculation only the first xattr provided by LSMs.
>
> Changing the evm_inode_init_security() definition requires passing the
> xattr array allocated by security_inode_init_security(), and the number of
> xattrs filled by previously invoked LSMs.
>
> Use the newly introduced lsm_get_xattr_slot() to position EVM correctly in
> the xattrs array, like a regular LSM, and to increment the number of filled
> slots. For now, the LSM infrastructure allocates enough xattrs slots to
> store the EVM xattr, without using the reservation mechanism.
>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH v11 4/4] evm: Support multiple LSMs providing an xattr
2023-06-03 19:15 [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
` (2 preceding siblings ...)
2023-06-03 19:15 ` [PATCH v11 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
@ 2023-06-03 19:15 ` Roberto Sassu
2023-06-06 16:09 ` [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Mimi Zohar
2023-06-09 20:05 ` Paul Moore
5 siblings, 0 replies; 17+ messages in thread
From: Roberto Sassu @ 2023-06-03 19:15 UTC (permalink / raw)
To: zohar, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
From: Roberto Sassu <roberto.sassu@huawei.com>
Currently, evm_inode_init_security() processes a single LSM xattr from the
array passed by security_inode_init_security(), and calculates the HMAC on
it and other inode metadata.
As the LSM infrastructure now can pass to EVM an array with multiple
xattrs, scan them until the terminator (xattr name NULL), and calculate the
HMAC on all of them.
Also, double check that the xattrs array terminator is the first non-filled
slot (obtained with lsm_get_xattr_slot()). Consumers of the xattrs array,
such as the initxattrs() callbacks, rely on the terminator.
Finally, change the name of the lsm_xattr parameter of evm_init_hmac() to
xattrs, to reflect the new type of information passed.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/evm/evm.h | 4 +++-
security/integrity/evm/evm_crypto.c | 11 +++++++++--
security/integrity/evm/evm_main.c | 29 +++++++++++++++++++++++++----
3 files changed, 37 insertions(+), 7 deletions(-)
diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h
index f8b8c5004fc..53bd7fec93f 100644
--- a/security/integrity/evm/evm.h
+++ b/security/integrity/evm/evm.h
@@ -46,6 +46,8 @@ struct evm_digest {
char digest[IMA_MAX_DIGEST_SIZE];
} __packed;
+int evm_protected_xattr(const char *req_xattr_name);
+
int evm_init_key(void);
int evm_update_evmxattr(struct dentry *dentry,
const char *req_xattr_name,
@@ -58,7 +60,7 @@ int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name,
const char *req_xattr_value,
size_t req_xattr_value_len, char type,
struct evm_digest *data);
-int evm_init_hmac(struct inode *inode, const struct xattr *xattr,
+int evm_init_hmac(struct inode *inode, const struct xattr *xattrs,
char *hmac_val);
int evm_init_secfs(void);
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 033804f5a5f..0fdd382b58e 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -385,10 +385,11 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name,
return rc;
}
-int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr,
+int evm_init_hmac(struct inode *inode, const struct xattr *xattrs,
char *hmac_val)
{
struct shash_desc *desc;
+ const struct xattr *xattr;
desc = init_desc(EVM_XATTR_HMAC, HASH_ALGO_SHA1);
if (IS_ERR(desc)) {
@@ -396,7 +397,13 @@ int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr,
return PTR_ERR(desc);
}
- crypto_shash_update(desc, lsm_xattr->value, lsm_xattr->value_len);
+ for (xattr = xattrs; xattr->name != NULL; xattr++) {
+ if (!evm_protected_xattr(xattr->name))
+ continue;
+
+ crypto_shash_update(desc, xattr->value, xattr->value_len);
+ }
+
hmac_add_misc(desc, inode, EVM_XATTR_HMAC, hmac_val);
kfree(desc);
return 0;
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 475196ce712..e9441419a81 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -306,7 +306,7 @@ static int evm_protected_xattr_common(const char *req_xattr_name,
return found;
}
-static int evm_protected_xattr(const char *req_xattr_name)
+int evm_protected_xattr(const char *req_xattr_name)
{
return evm_protected_xattr_common(req_xattr_name, false);
}
@@ -870,14 +870,35 @@ int evm_inode_init_security(struct inode *inode, struct inode *dir,
int *xattr_count)
{
struct evm_xattr *xattr_data;
- struct xattr *evm_xattr;
+ struct xattr *xattr, *evm_xattr;
+ bool evm_protected_xattrs = false;
int rc;
- if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||
- !evm_protected_xattr(xattrs->name))
+ if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs)
+ return 0;
+
+ /*
+ * security_inode_init_security() makes sure that the xattrs array is
+ * contiguous, there is enough space for security.evm, and that there is
+ * a terminator at the end of the array.
+ */
+ for (xattr = xattrs; xattr->name != NULL; xattr++) {
+ if (evm_protected_xattr(xattr->name))
+ evm_protected_xattrs = true;
+ }
+
+ /* EVM xattr not needed. */
+ if (!evm_protected_xattrs)
return 0;
evm_xattr = lsm_get_xattr_slot(xattrs, xattr_count);
+ /*
+ * Array terminator (xattr name = NULL) must be the first non-filled
+ * xattr slot.
+ */
+ WARN_ONCE(evm_xattr != xattr,
+ "%s: xattrs terminator is not the first non-filled slot\n",
+ __func__);
xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
if (!xattr_data)
--
2.25.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes
2023-06-03 19:15 [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
` (3 preceding siblings ...)
2023-06-03 19:15 ` [PATCH v11 4/4] evm: Support multiple LSMs providing an xattr Roberto Sassu
@ 2023-06-06 16:09 ` Mimi Zohar
2023-06-06 16:16 ` Roberto Sassu
2023-06-09 20:05 ` Paul Moore
5 siblings, 1 reply; 17+ messages in thread
From: Mimi Zohar @ 2023-06-06 16:09 UTC (permalink / raw)
To: Roberto Sassu, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
Hi Roberto,
Based on which git repo/branch does this patch set apply? In the
future please include the "--base" option.
--
thanks,
Mimi
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes
2023-06-06 16:09 ` [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Mimi Zohar
@ 2023-06-06 16:16 ` Roberto Sassu
0 siblings, 0 replies; 17+ messages in thread
From: Roberto Sassu @ 2023-06-06 16:16 UTC (permalink / raw)
To: Mimi Zohar, dmitry.kasatkin, paul, jmorris, serge,
stephen.smalley.work, eparis, casey
Cc: linux-kernel, linux-integrity, linux-security-module, selinux,
bpf, kpsingh, keescook, nicolas.bouchinet, Roberto Sassu
On Tue, 2023-06-06 at 12:09 -0400, Mimi Zohar wrote:
> Hi Roberto,
>
> Based on which git repo/branch does this patch set apply? In the
> future please include the "--base" option.
Hi Mimi
yes, sorry, I forgot to add this information.
It applies on:
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git/log/?h=next
plus:
https://github.com/cschaufler/smack-next/commits/next
Roberto
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes
2023-06-03 19:15 [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
` (4 preceding siblings ...)
2023-06-06 16:09 ` [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Mimi Zohar
@ 2023-06-09 20:05 ` Paul Moore
2023-06-10 8:00 ` Roberto Sassu
5 siblings, 1 reply; 17+ messages in thread
From: Paul Moore @ 2023-06-09 20:05 UTC (permalink / raw)
To: Roberto Sassu
Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
eparis, casey, linux-kernel, linux-integrity,
linux-security-module, selinux, bpf, kpsingh, keescook,
nicolas.bouchinet, Roberto Sassu
On Sat, Jun 3, 2023 at 3:16 PM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
>
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> One of the major goals of LSM stacking is to run multiple LSMs side by side
> without interfering with each other. The ultimate decision will depend on
> individual LSM decision.
>
> Several changes need to be made to the LSM infrastructure to be able to
> support that. This patch set tackles one of them: gives to each LSM the
> ability to specify one or multiple xattrs to be set at inode creation
> time and, at the same time, gives to EVM the ability to access all those
> xattrs and calculate the HMAC on them ...
Thanks for sticking with this Roberto, I see a few
comments/suggestions on this patchset, but overall it is looking
pretty good; I'm hopeful we will be able to merge the next revision.
--
paul-moore.com
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes
2023-06-09 20:05 ` Paul Moore
@ 2023-06-10 8:00 ` Roberto Sassu
0 siblings, 0 replies; 17+ messages in thread
From: Roberto Sassu @ 2023-06-10 8:00 UTC (permalink / raw)
To: Paul Moore
Cc: zohar, dmitry.kasatkin, jmorris, serge, stephen.smalley.work,
eparis, casey, linux-kernel, linux-integrity,
linux-security-module, selinux, bpf, kpsingh, keescook,
nicolas.bouchinet, Roberto Sassu
On 6/9/2023 10:05 PM, Paul Moore wrote:
> On Sat, Jun 3, 2023 at 3:16 PM Roberto Sassu
> <roberto.sassu@huaweicloud.com> wrote:
>>
>> From: Roberto Sassu <roberto.sassu@huawei.com>
>>
>> One of the major goals of LSM stacking is to run multiple LSMs side by side
>> without interfering with each other. The ultimate decision will depend on
>> individual LSM decision.
>>
>> Several changes need to be made to the LSM infrastructure to be able to
>> support that. This patch set tackles one of them: gives to each LSM the
>> ability to specify one or multiple xattrs to be set at inode creation
>> time and, at the same time, gives to EVM the ability to access all those
>> xattrs and calculate the HMAC on them ...
>
> Thanks for sticking with this Roberto, I see a few
> comments/suggestions on this patchset, but overall it is looking
> pretty good; I'm hopeful we will be able to merge the next revision.
Thanks for looking at it.
Just sent v12 with the suggestions. One is addressed with a different
patch set (Smack transmute fixes).
Roberto
^ permalink raw reply [flat|nested] 17+ messages in thread