diff mbox series

[23/28] security: Introduce LSM_ORDER_LAST

Message ID	20230303182602.1088032-1-roberto.sassu@huaweicloud.com
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; From: Roberto Sassu <roberto.sassu@huaweicloud.com> To: viro@zeniv.linux.org.uk, chuck.lever@oracle.com, jlayton@kernel.org, zohar@linux.ibm.com, dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, dhowells@redhat.com, jarkko@kernel.org, stephen.smalley.work@gmail.com, eparis@parisplace.org, casey@schaufler-ca.com, brauner@kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, selinux@vger.kernel.org, linux-kernel@vger.kernel.org, stefanb@linux.ibm.com, Roberto Sassu <roberto.sassu@huawei.com> Subject: [PATCH 23/28] security: Introduce LSM_ORDER_LAST Date: Fri, 3 Mar 2023 19:25:57 +0100 Message-Id: <20230303182602.1088032-1-roberto.sassu@huaweicloud.com> In-Reply-To: <20230303181842.1087717-1-roberto.sassu@huaweicloud.com> References: <20230303181842.1087717-1-roberto.sassu@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	security: Move IMA and EVM to the LSM infrastructure \| [00/28] security: Move IMA and EVM to the LSM infrastructure [01/28] ima: Align ima_inode_post_setattr() definition with LSM infrastructure [02/28] ima: Align ima_post_path_mknod() definition with LSM infrastructure [03/28] ima: Align ima_post_create_tmpfile() definition with LSM infrastructure [04/28] ima: Align ima_file_mprotect() definition with LSM infrastructure [05/28] ima: Align ima_inode_setxattr() definition with LSM infrastructure [06/28] ima: Align ima_inode_removexattr() definition with LSM infrastructure [07/28] ima: Align ima_post_read_file() definition with LSM infrastructure [08/28] evm: Align evm_inode_post_setattr() definition with LSM infrastructure [09/28] evm: Align evm_inode_setxattr() definition with LSM infrastructure [10/28] evm: Align evm_inode_post_setxattr() definition with LSM infrastructure [11/28] evm: Complete description of evm_inode_setattr() [12/28] fs: Fix description of vfs_tmpfile() [13/28] security: Align inode_setattr hook definition with EVM [14/28] security: Introduce inode_post_setattr hook [15/28] security: Introduce inode_post_removexattr hook [16/28] security: Introduce file_post_open hook [17/28] security: Introduce file_pre_free_security hook [18/28] security: Introduce path_post_mknod hook [19/28] security: Introduce inode_post_create_tmpfile hook [20/28] security: Introduce inode_post_set_acl hook [21/28] security: Introduce inode_post_remove_acl hook [22/28] security: Introduce key_post_create_or_update hook [23/28] security: Introduce LSM_ORDER_LAST [24/28] ima: Move to LSM infrastructure [25/28] ima: Move IMA-Appraisal to LSM infrastructure [26/28] evm: Move to LSM infrastructure [27/28] integrity: Move integrity functions to the LSM infrastructure [28/28] integrity: Switch from rbtree to LSM-managed blob for integrity_iint_cache

Commit Message

Roberto Sassu March 3, 2023, 6:25 p.m. UTC

  From: Roberto Sassu <roberto.sassu@huawei.com>

Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
the last, e.g. the 'integrity' LSM, without changing the kernel command
line or configuration.

As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
at the end of the LSM list in no particular order.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 include/linux/lsm_hooks.h |  1 +
 security/security.c       | 12 +++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

Comments

Stefan Berger March 7, 2023, 6:04 p.m. UTC | #1

On 3/3/23 13:25, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
> the last, e.g. the 'integrity' LSM, without changing the kernel command
> line or configuration.
> 
> As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
> at the end of the LSM list in no particular order.
> 

I think you should describe the reason for the change for LSM_ORDER_MUTABLE as well.


> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>   include/linux/lsm_hooks.h |  1 +
>   security/security.c       | 12 +++++++++---
>   2 files changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index 21a8ce23108..05c4b831d99 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -93,6 +93,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
>   enum lsm_order {
>   	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
>   	LSM_ORDER_MUTABLE = 0,
> +	LSM_ORDER_LAST = 1,
>   };
>   
>   struct lsm_info {
> diff --git a/security/security.c b/security/security.c
> index 322090a50cd..24f52ba3218 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -284,9 +284,9 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>   		bool found = false;
>   
>   		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> -			if (lsm->order == LSM_ORDER_MUTABLE &&
> -			    strcmp(lsm->name, name) == 0) {
> -				append_ordered_lsm(lsm, origin);
> +			if (strcmp(lsm->name, name) == 0) {
> +				if (lsm->order == LSM_ORDER_MUTABLE)
> +					append_ordered_lsm(lsm, origin);
>   				found = true;
>   			}
>   		}
> @@ -306,6 +306,12 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>   		}
>   	}
>   
> +	/* LSM_ORDER_LAST is always last. */
> +	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> +		if (lsm->order == LSM_ORDER_LAST)
> +			append_ordered_lsm(lsm, "   last");
> +	}
> +
>   	/* Disable all LSMs not in the ordered list. */
>   	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
>   		if (exists_ordered_lsm(lsm))

Roberto Sassu March 8, 2023, 8:06 a.m. UTC | #2

On Tue, 2023-03-07 at 13:04 -0500, Stefan Berger wrote:
> 
> On 3/3/23 13:25, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> > 
> > Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
> > the last, e.g. the 'integrity' LSM, without changing the kernel command
> > line or configuration.
> > 
> > As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
> > at the end of the LSM list in no particular order.
> > 
> 
> I think you should describe the reason for the change for LSM_ORDER_MUTABLE as well.

Right.

Thanks

Roberto

> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> >   include/linux/lsm_hooks.h |  1 +
> >   security/security.c       | 12 +++++++++---
> >   2 files changed, 10 insertions(+), 3 deletions(-)
> > 
> > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> > index 21a8ce23108..05c4b831d99 100644
> > --- a/include/linux/lsm_hooks.h
> > +++ b/include/linux/lsm_hooks.h
> > @@ -93,6 +93,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
> >   enum lsm_order {
> >   	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
> >   	LSM_ORDER_MUTABLE = 0,
> > +	LSM_ORDER_LAST = 1,
> >   };
> >   
> >   struct lsm_info {
> > diff --git a/security/security.c b/security/security.c
> > index 322090a50cd..24f52ba3218 100644
> > --- a/security/security.c
> > +++ b/security/security.c
> > @@ -284,9 +284,9 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> >   		bool found = false;
> >   
> >   		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > -			if (lsm->order == LSM_ORDER_MUTABLE &&
> > -			    strcmp(lsm->name, name) == 0) {
> > -				append_ordered_lsm(lsm, origin);
> > +			if (strcmp(lsm->name, name) == 0) {
> > +				if (lsm->order == LSM_ORDER_MUTABLE)
> > +					append_ordered_lsm(lsm, origin);
> >   				found = true;
> >   			}
> >   		}
> > @@ -306,6 +306,12 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> >   		}
> >   	}
> >   
> > +	/* LSM_ORDER_LAST is always last. */
> > +	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > +		if (lsm->order == LSM_ORDER_LAST)
> > +			append_ordered_lsm(lsm, "   last");
> > +	}
> > +
> >   	/* Disable all LSMs not in the ordered list. */
> >   	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> >   		if (exists_ordered_lsm(lsm))

Mimi Zohar March 8, 2023, 1:13 p.m. UTC | #3

Hi Roberto,

On Fri, 2023-03-03 at 19:25 +0100, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
> the last, e.g. the 'integrity' LSM, without changing the kernel command
> line or configuration.

Please reframe this as a bug fix for 79f7865d844c ("LSM: Introduce
"lsm=" for boottime LSM selection") and upstream it first, with
'integrity' as the last LSM.   The original bug fix commit 92063f3ca73a
("integrity: double check iint_cache was initialized") could then be
removed.

> 
> As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
> at the end of the LSM list in no particular order.

^Similar to LSM_ORDER_FIRST ...

And remove "in no particular order".

> 
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>  include/linux/lsm_hooks.h |  1 +
>  security/security.c       | 12 +++++++++---
>  2 files changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index 21a8ce23108..05c4b831d99 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -93,6 +93,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
>  enum lsm_order {
>  	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
>  	LSM_ORDER_MUTABLE = 0,
> +	LSM_ORDER_LAST = 1,
>  };
>  
>  struct lsm_info {
> diff --git a/security/security.c b/security/security.c
> index 322090a50cd..24f52ba3218 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -284,9 +284,9 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>  		bool found = false;
>  
>  		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> -			if (lsm->order == LSM_ORDER_MUTABLE &&
> -			    strcmp(lsm->name, name) == 0) {
> -				append_ordered_lsm(lsm, origin);
> +			if (strcmp(lsm->name, name) == 0) {
> +				if (lsm->order == LSM_ORDER_MUTABLE)
> +					append_ordered_lsm(lsm, origin);
>  				found = true;
>  			}
>  		}
> @@ -306,6 +306,12 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>  		}
>  	}
>  
> +	/* LSM_ORDER_LAST is always last. */
> +	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> +		if (lsm->order == LSM_ORDER_LAST)
> +			append_ordered_lsm(lsm, "   last");
> +	}
> +
>  	/* Disable all LSMs not in the ordered list. */
>  	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
>  		if (exists_ordered_lsm(lsm))

Roberto Sassu March 8, 2023, 1:26 p.m. UTC | #4

On Wed, 2023-03-08 at 08:13 -0500, Mimi Zohar wrote:
> Hi Roberto,
> 
> On Fri, 2023-03-03 at 19:25 +0100, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> > 
> > Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
> > the last, e.g. the 'integrity' LSM, without changing the kernel command
> > line or configuration.
> 
> Please reframe this as a bug fix for 79f7865d844c ("LSM: Introduce
> "lsm=" for boottime LSM selection") and upstream it first, with
> 'integrity' as the last LSM.   The original bug fix commit 92063f3ca73a
> ("integrity: double check iint_cache was initialized") could then be
> removed.

Ok, I should complete the patch by checking the cache initialization in
iint.c.

> > As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
> > at the end of the LSM list in no particular order.
> 
> ^Similar to LSM_ORDER_FIRST ...
> 
> And remove "in no particular order".

The reason for this is that I originally thought that the relative
order of LSMs specified in the kernel configuration or the command line
was respected (if more than one LSM specifies LSM_ORDER_LAST). In fact
not. To do this, we would have to parse the LSM string again, as it is
done for LSM_ORDER_MUTABLE LSMs.

Thanks

Roberto

> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> >  include/linux/lsm_hooks.h |  1 +
> >  security/security.c       | 12 +++++++++---
> >  2 files changed, 10 insertions(+), 3 deletions(-)
> > 
> > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> > index 21a8ce23108..05c4b831d99 100644
> > --- a/include/linux/lsm_hooks.h
> > +++ b/include/linux/lsm_hooks.h
> > @@ -93,6 +93,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
> >  enum lsm_order {
> >  	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
> >  	LSM_ORDER_MUTABLE = 0,
> > +	LSM_ORDER_LAST = 1,
> >  };
> >  
> >  struct lsm_info {
> > diff --git a/security/security.c b/security/security.c
> > index 322090a50cd..24f52ba3218 100644
> > --- a/security/security.c
> > +++ b/security/security.c
> > @@ -284,9 +284,9 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> >  		bool found = false;
> >  
> >  		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > -			if (lsm->order == LSM_ORDER_MUTABLE &&
> > -			    strcmp(lsm->name, name) == 0) {
> > -				append_ordered_lsm(lsm, origin);
> > +			if (strcmp(lsm->name, name) == 0) {
> > +				if (lsm->order == LSM_ORDER_MUTABLE)
> > +					append_ordered_lsm(lsm, origin);
> >  				found = true;
> >  			}
> >  		}
> > @@ -306,6 +306,12 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> >  		}
> >  	}
> >  
> > +	/* LSM_ORDER_LAST is always last. */
> > +	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > +		if (lsm->order == LSM_ORDER_LAST)
> > +			append_ordered_lsm(lsm, "   last");
> > +	}
> > +
> >  	/* Disable all LSMs not in the ordered list. */
> >  	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> >  		if (exists_ordered_lsm(lsm))

Mimi Zohar March 8, 2023, 2 p.m. UTC | #5

On Wed, 2023-03-08 at 14:26 +0100, Roberto Sassu wrote:
> On Wed, 2023-03-08 at 08:13 -0500, Mimi Zohar wrote:
> > Hi Roberto,
> > 
> > On Fri, 2023-03-03 at 19:25 +0100, Roberto Sassu wrote:
> > > From: Roberto Sassu <roberto.sassu@huawei.com>
> > > 
> > > Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
> > > the last, e.g. the 'integrity' LSM, without changing the kernel command
> > > line or configuration.
> > 
> > Please reframe this as a bug fix for 79f7865d844c ("LSM: Introduce
> > "lsm=" for boottime LSM selection") and upstream it first, with
> > 'integrity' as the last LSM.   The original bug fix commit 92063f3ca73a
> > ("integrity: double check iint_cache was initialized") could then be
> > removed.
> 
> Ok, I should complete the patch by checking the cache initialization in
> iint.c.
> 
> > > As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
> > > at the end of the LSM list in no particular order.
> > 
> > ^Similar to LSM_ORDER_FIRST ...
> > 
> > And remove "in no particular order".
> 
> The reason for this is that I originally thought that the relative
> order of LSMs specified in the kernel configuration or the command line
> was respected (if more than one LSM specifies LSM_ORDER_LAST). In fact
> not. To do this, we would have to parse the LSM string again, as it is
> done for LSM_ORDER_MUTABLE LSMs.

IMA and EVM are only configurable if 'integrity' is enabled.  Similar
to how LSM_ORDER_FIRST is reserved for capabilities, LSM_ORDER_LAST
should be reserved for integrity (LSMs), if it is configured, for the
reason as described in the "[PATCH 24/28] ima: Move to LSM
infrastructure" patch description.

> 
> Thanks
> 
> Roberto
> 
> > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > > ---
> > >  include/linux/lsm_hooks.h |  1 +
> > >  security/security.c       | 12 +++++++++---
> > >  2 files changed, 10 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> > > index 21a8ce23108..05c4b831d99 100644
> > > --- a/include/linux/lsm_hooks.h
> > > +++ b/include/linux/lsm_hooks.h
> > > @@ -93,6 +93,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
> > >  enum lsm_order {
> > >  	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
> > >  	LSM_ORDER_MUTABLE = 0,
> > > +	LSM_ORDER_LAST = 1,
> > >  };
> > >  
> > >  struct lsm_info {
> > > diff --git a/security/security.c b/security/security.c
> > > index 322090a50cd..24f52ba3218 100644
> > > --- a/security/security.c
> > > +++ b/security/security.c
> > > @@ -284,9 +284,9 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> > >  		bool found = false;
> > >  
> > >  		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > > -			if (lsm->order == LSM_ORDER_MUTABLE &&
> > > -			    strcmp(lsm->name, name) == 0) {
> > > -				append_ordered_lsm(lsm, origin);
> > > +			if (strcmp(lsm->name, name) == 0) {
> > > +				if (lsm->order == LSM_ORDER_MUTABLE)
> > > +					append_ordered_lsm(lsm, origin);
> > >  				found = true;
> > >  			}
> > >  		}
> > > @@ -306,6 +306,12 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> > >  		}
> > >  	}
> > >  
> > > +	/* LSM_ORDER_LAST is always last. */
> > > +	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > > +		if (lsm->order == LSM_ORDER_LAST)
> > > +			append_ordered_lsm(lsm, "   last");
> > > +	}
> > > +
> > >  	/* Disable all LSMs not in the ordered list. */
> > >  	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > >  		if (exists_ordered_lsm(lsm))
>

Roberto Sassu March 8, 2023, 2:35 p.m. UTC | #6

On Wed, 2023-03-08 at 09:00 -0500, Mimi Zohar wrote:
> On Wed, 2023-03-08 at 14:26 +0100, Roberto Sassu wrote:
> > On Wed, 2023-03-08 at 08:13 -0500, Mimi Zohar wrote:
> > > Hi Roberto,
> > > 
> > > On Fri, 2023-03-03 at 19:25 +0100, Roberto Sassu wrote:
> > > > From: Roberto Sassu <roberto.sassu@huawei.com>
> > > > 
> > > > Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
> > > > the last, e.g. the 'integrity' LSM, without changing the kernel command
> > > > line or configuration.
> > > 
> > > Please reframe this as a bug fix for 79f7865d844c ("LSM: Introduce
> > > "lsm=" for boottime LSM selection") and upstream it first, with
> > > 'integrity' as the last LSM.   The original bug fix commit 92063f3ca73a
> > > ("integrity: double check iint_cache was initialized") could then be
> > > removed.
> > 
> > Ok, I should complete the patch by checking the cache initialization in
> > iint.c.
> > 
> > > > As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
> > > > at the end of the LSM list in no particular order.
> > > 
> > > ^Similar to LSM_ORDER_FIRST ...
> > > 
> > > And remove "in no particular order".
> > 
> > The reason for this is that I originally thought that the relative
> > order of LSMs specified in the kernel configuration or the command line
> > was respected (if more than one LSM specifies LSM_ORDER_LAST). In fact
> > not. To do this, we would have to parse the LSM string again, as it is
> > done for LSM_ORDER_MUTABLE LSMs.
> 
> IMA and EVM are only configurable if 'integrity' is enabled.  Similar
> to how LSM_ORDER_FIRST is reserved for capabilities, LSM_ORDER_LAST
> should be reserved for integrity (LSMs), if it is configured, for the
> reason as described in the "[PATCH 24/28] ima: Move to LSM
> infrastructure" patch description.

Yes, it is just that nothing prevents to have multiple LSMs with order
LSM_ORDER_LAST. I guess we will enforce that it is only one by
reviewing the code.

Thanks

Roberto

> > Thanks
> > 
> > Roberto
> > 
> > > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > > > ---
> > > >  include/linux/lsm_hooks.h |  1 +
> > > >  security/security.c       | 12 +++++++++---
> > > >  2 files changed, 10 insertions(+), 3 deletions(-)
> > > > 
> > > > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> > > > index 21a8ce23108..05c4b831d99 100644
> > > > --- a/include/linux/lsm_hooks.h
> > > > +++ b/include/linux/lsm_hooks.h
> > > > @@ -93,6 +93,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
> > > >  enum lsm_order {
> > > >  	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
> > > >  	LSM_ORDER_MUTABLE = 0,
> > > > +	LSM_ORDER_LAST = 1,
> > > >  };
> > > >  
> > > >  struct lsm_info {
> > > > diff --git a/security/security.c b/security/security.c
> > > > index 322090a50cd..24f52ba3218 100644
> > > > --- a/security/security.c
> > > > +++ b/security/security.c
> > > > @@ -284,9 +284,9 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> > > >  		bool found = false;
> > > >  
> > > >  		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > > > -			if (lsm->order == LSM_ORDER_MUTABLE &&
> > > > -			    strcmp(lsm->name, name) == 0) {
> > > > -				append_ordered_lsm(lsm, origin);
> > > > +			if (strcmp(lsm->name, name) == 0) {
> > > > +				if (lsm->order == LSM_ORDER_MUTABLE)
> > > > +					append_ordered_lsm(lsm, origin);
> > > >  				found = true;
> > > >  			}
> > > >  		}
> > > > @@ -306,6 +306,12 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
> > > >  		}
> > > >  	}
> > > >  
> > > > +	/* LSM_ORDER_LAST is always last. */
> > > > +	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > > > +		if (lsm->order == LSM_ORDER_LAST)
> > > > +			append_ordered_lsm(lsm, "   last");
> > > > +	}
> > > > +
> > > >  	/* Disable all LSMs not in the ordered list. */
> > > >  	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
> > > >  		if (exists_ordered_lsm(lsm))

Mimi Zohar March 8, 2023, 3:52 p.m. UTC | #7

On Wed, 2023-03-08 at 15:35 +0100, Roberto Sassu wrote:
> On Wed, 2023-03-08 at 09:00 -0500, Mimi Zohar wrote:
> > On Wed, 2023-03-08 at 14:26 +0100, Roberto Sassu wrote:
> > > On Wed, 2023-03-08 at 08:13 -0500, Mimi Zohar wrote:
> > > > Hi Roberto,
> > > > 
> > > > On Fri, 2023-03-03 at 19:25 +0100, Roberto Sassu wrote:
> > > > > From: Roberto Sassu <roberto.sassu@huawei.com>
> > > > > 
> > > > > Introduce LSM_ORDER_LAST, to satisfy the requirement of LSMs willing to be
> > > > > the last, e.g. the 'integrity' LSM, without changing the kernel command
> > > > > line or configuration.
> > > > 
> > > > Please reframe this as a bug fix for 79f7865d844c ("LSM: Introduce
> > > > "lsm=" for boottime LSM selection") and upstream it first, with
> > > > 'integrity' as the last LSM.   The original bug fix commit 92063f3ca73a
> > > > ("integrity: double check iint_cache was initialized") could then be
> > > > removed.
> > > 
> > > Ok, I should complete the patch by checking the cache initialization in
> > > iint.c.
> > > 
> > > > > As for LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled and put
> > > > > at the end of the LSM list in no particular order.
> > > > 
> > > > ^Similar to LSM_ORDER_FIRST ...
> > > > 
> > > > And remove "in no particular order".
> > > 
> > > The reason for this is that I originally thought that the relative
> > > order of LSMs specified in the kernel configuration or the command line
> > > was respected (if more than one LSM specifies LSM_ORDER_LAST). In fact
> > > not. To do this, we would have to parse the LSM string again, as it is
> > > done for LSM_ORDER_MUTABLE LSMs.
> > 
> > IMA and EVM are only configurable if 'integrity' is enabled.  Similar
> > to how LSM_ORDER_FIRST is reserved for capabilities, LSM_ORDER_LAST
> > should be reserved for integrity (LSMs), if it is configured, for the
> > reason as described in the "[PATCH 24/28] ima: Move to LSM
> > infrastructure" patch description.
> 
> Yes, it is just that nothing prevents to have multiple LSMs with order
> LSM_ORDER_LAST. I guess we will enforce that it is only one by
> reviewing the code.

At least add a comment, like the existing one for LSM_ORDER_FIRST.

> > > >  enum lsm_order {
> > > > >  	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
> > > > >  	LSM_ORDER_MUTABLE = 0,
> > > > > +	LSM_ORDER_LAST = 1,
> > > > >  };

diff mbox series

Patch

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 21a8ce23108..05c4b831d99 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -93,6 +93,7 @@  extern void security_add_hooks(struct security_hook_list *hooks, int count,
 enum lsm_order {
 	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
 	LSM_ORDER_MUTABLE = 0,
+	LSM_ORDER_LAST = 1,
 };
 
 struct lsm_info {
diff --git a/security/security.c b/security/security.c
index 322090a50cd..24f52ba3218 100644
--- a/security/security.c
+++ b/security/security.c
@@ -284,9 +284,9 @@  static void __init ordered_lsm_parse(const char *order, const char *origin)
 		bool found = false;
 
 		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
-			if (lsm->order == LSM_ORDER_MUTABLE &&
-			    strcmp(lsm->name, name) == 0) {
-				append_ordered_lsm(lsm, origin);
+			if (strcmp(lsm->name, name) == 0) {
+				if (lsm->order == LSM_ORDER_MUTABLE)
+					append_ordered_lsm(lsm, origin);
 				found = true;
 			}
 		}
@@ -306,6 +306,12 @@  static void __init ordered_lsm_parse(const char *order, const char *origin)
 		}
 	}
 
+	/* LSM_ORDER_LAST is always last. */
+	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
+		if (lsm->order == LSM_ORDER_LAST)
+			append_ordered_lsm(lsm, "   last");
+	}
+
 	/* Disable all LSMs not in the ordered list. */
 	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
 		if (exists_ordered_lsm(lsm))