From patchwork Thu Feb 29 00:54:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fan Wu X-Patchwork-Id: 208131 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:2097:b0:108:e6aa:91d0 with SMTP id gs23csp103638dyb; Wed, 28 Feb 2024 17:01:20 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCU9K1pN0ytM38tC5J1aemyAEtN1SwrDbI+Sn6sCmJrqANnoEjbtGKYiL8ZO4LuF/jPFbwJFG550vxdCrnsgVR15S07rDg== X-Google-Smtp-Source: AGHT+IEX2+Zy4U6vtikNuuhetMPy/+5Y0UgNld83HGxkP1iCV00XH9UUK+w+dfbRAYSb4qehmJax X-Received: by 2002:a05:6102:90a:b0:470:3a61:8f9 with SMTP id x10-20020a056102090a00b004703a6108f9mr149399vsh.14.1709168480470; Wed, 28 Feb 2024 17:01:20 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1709168480; cv=pass; d=google.com; s=arc-20160816; b=pBn34lX99QRdp9rycnWRRCRnnVzcpFP1jUi4QZ0AT+W1SVStaqEgivgGIAMXoahq5D +9pSK58ddFzz9nQ5luO5c08nZIf9InKTgDpBCNKZ4HC6uqk0qD2aTn3D/U1z5qruGiSj cdxsB8CXOf6+xgmR6ZX9KsmmY6hVksvnw8Y9siWv8qJi3P51wnDkf57Khb/pmGgu0uwe w2Y7XxiZXLzARP4tCGLxoX3W4oL5tlx9KWJU2CeDfnlAF78XgPh7HPpsVnYRGuE3FB9u hqZEkoBMJGx5+rBd6XliJy/XFb5AV5oJJo6ahJLBCeSXqtV1EpYVeW5Ezwx3k/cjMdSl nHcQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-id:precedence:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature :dkim-filter; bh=n4XDUzOCbsgAA3YIf1ke1kcBW1A7f0Vj6x0f6D3Nii0=; fh=ZmGiH+lw6z1T3S6eiUfQyDZQSgoTP0oNqIEgu6aD32Y=; b=fz5ReExAi8Jh/kewyh62OGfxbEJys0JUKa46fxxQjdee4M1ocBLy8ZVlMbiWDCq4oB +JyXtMqOAICLEqyGdKPYpJ96Y4vclkLKccRGTSMYHOXlxTav8ZpVf/45Ve5PTDKGAYPE LrAPp9Ul3fbT9ur2hPTjMj4eTCsfudWr155AjPC6nyjZkbfCtkOY4u4hUQeOiUmaKvlL jJrI6yAou1FBtqTCyXxWD7HqgMNkng31OqfO/ZFcJNa7BuLdy6/LNOwlT6YHqiZB4odc YMr4z8bbJPC7+/uHNp1JbaTW4Sybfho04c0Ee6f7GddJiC2gjEdI0qfd6hD8t3TYuONB QY1Q==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=mOgtR2CT; arc=pass (i=1 spf=pass spfdomain=linux.microsoft.com dkim=pass dkdomain=linux.microsoft.com dmarc=pass fromdomain=linux.microsoft.com); spf=pass (google.com: domain of linux-kernel+bounces-85956-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-85956-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [2604:1380:45d1:ec00::1]) by mx.google.com with ESMTPS id t13-20020a67f90d000000b0047264badf4asi33072vsq.553.2024.02.28.17.01.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Feb 2024 17:01:20 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-85956-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=mOgtR2CT; arc=pass (i=1 spf=pass spfdomain=linux.microsoft.com dkim=pass dkdomain=linux.microsoft.com dmarc=pass fromdomain=linux.microsoft.com); spf=pass (google.com: domain of linux-kernel+bounces-85956-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-85956-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id 411FF1C240D1 for ; Thu, 29 Feb 2024 01:01:20 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 442373A267; Thu, 29 Feb 2024 00:55:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="mOgtR2CT" Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 1F9EA2E40D; Thu, 29 Feb 2024 00:55:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709168129; cv=none; b=R4PUr1HiBTyNgg0DjIF5nh1iGDoaqJWyVRvxPM/8s7nx90tmiPs/jfInP9gOc92g5fZHcgqY4efR0NdfcWvo8gvIkJrBgTvQafC9vei/XLEbZ4SkrJLy2Gdm5hZbO5Iqcg1zvwcORioTUSMV8dFKkVA2x8zLuSxFz0FXnuowATg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709168129; c=relaxed/simple; bh=2rBgAgNDOrr6bqM89LE0qWlDhVmtDEZuN0fXBUzM0ts=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=ZsIvZSwZuQd+syXUrxuEhOiweEzB3igEOMkJiczr8Wf/BScZ3X47linjJqPGD0PL9t/ERTDWo+UMFLasU2TNVNpG3yU8Re604Sg1+fWztgnxhXJK53f7QTLtvaShKCCTkPADDhc3g/16OjDjKHTYNJl+4HqG/58LMtILYhWG0TI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=mOgtR2CT; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Received: by linux.microsoft.com (Postfix, from userid 1052) id 4DDE520B74DF; Wed, 28 Feb 2024 16:55:18 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 4DDE520B74DF DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1709168119; bh=n4XDUzOCbsgAA3YIf1ke1kcBW1A7f0Vj6x0f6D3Nii0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mOgtR2CTW4BZw3S7AAg3D7HZXR3+2sP8HgX/DSASJe0bsbXDmKr+O4MDUonBrG93g Es16LmDRXj05OXwAav0bgwPIyiA2lG8yvLdLZ92+rQRka8egVChQVJv9JPvHrXvWgO 4ow0nd93keXxiPhzBiPNICCi5r9WW+rBEl2zjmzQ= From: Fan Wu To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-block@vger.kernel.org, dm-devel@lists.linux.dev, audit@vger.kernel.org, linux-kernel@vger.kernel.org, Fan Wu , Deven Bowers Subject: [RFC PATCH v13 16/20] fsverity: consume builtin signature via LSM hook Date: Wed, 28 Feb 2024 16:54:58 -0800 Message-Id: <1709168102-7677-17-git-send-email-wufan@linux.microsoft.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1709168102-7677-1-git-send-email-wufan@linux.microsoft.com> References: <1709168102-7677-1-git-send-email-wufan@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1792193048723001008 X-GMAIL-MSGID: 1792193048723001008 fsverity represents a mechanism to support both integrity and authenticity protection of a file, supporting both signed and unsigned digests. An LSM which controls access to a resource based on authenticity and integrity of said resource, can then use this data to make an informed decision on the authorization (provided by the LSM's policy) of said claim. This effectively allows the extension of a policy enforcement layer in LSM for fsverity, allowing for more granular control of how a particular authenticity claim can be used. For example, "all (built-in) signed fsverity files should be allowed to execute, but only these hashes are allowed to be loaded as kernel modules". This enforcement must be done in kernel space, as a userspace only solution would fail a simple litmus test: Download a self-contained malicious binary that never touches the userspace stack. This binary would still be able to execute. Signed-off-by: Deven Bowers Signed-off-by: Fan Wu --- v1-v6: + Not present v7: Introduced v8: + Split fs/verity/ changes and security/ changes into separate patches + Change signature of fsverity_create_info to accept non-const inode + Change signature of fsverity_verify_signature to accept non-const inode + Don't cast-away const from inode. + Digest functionality dropped in favor of: ("fs-verity: define a function to return the integrity protected file digest") + Reworded commit description and title to match changes. + Fix a bug wherein no LSM implements the particular fsverity @name (or LSM is disabled), and returns -EOPNOTSUPP, causing errors. v9: + No changes v10: + Rename the signature blob key + Cleanup redundant code + Make the hook call depends on CONFIG_FS_VERITY_BUILTIN_SIGNATURES v11: + No changes v12: + Add constification to the hook call v13: + No changes --- fs/verity/fsverity_private.h | 2 +- fs/verity/open.c | 26 +++++++++++++++++++++++++- include/linux/fsverity.h | 2 ++ 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h index a6a6b2749241..84a3608f2f9b 100644 --- a/fs/verity/fsverity_private.h +++ b/fs/verity/fsverity_private.h @@ -118,7 +118,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, unsigned int log_blocksize, const u8 *salt, size_t salt_size); -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc); void fsverity_set_info(struct inode *inode, struct fsverity_info *vi); diff --git a/fs/verity/open.c b/fs/verity/open.c index 6c31a871b84b..f917023255c8 100644 --- a/fs/verity/open.c +++ b/fs/verity/open.c @@ -8,6 +8,7 @@ #include "fsverity_private.h" #include +#include #include static struct kmem_cache *fsverity_info_cachep; @@ -172,12 +173,28 @@ static int compute_file_digest(const struct fsverity_hash_alg *hash_alg, return err; } +#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES +static int fsverity_inode_setsecurity(struct inode *inode, + const struct fsverity_descriptor *desc) +{ + return security_inode_setsecurity(inode, FS_VERITY_INODE_SEC_NAME, + desc->signature, + le32_to_cpu(desc->sig_size), 0); +} +#else +static inline int fsverity_inode_setsecurity(struct inode *inode, + const struct fsverity_descriptor *desc) +{ + return 0; +} +#endif /* CONFIG_IPE_PROP_FS_VERITY*/ + /* * Create a new fsverity_info from the given fsverity_descriptor (with optional * appended builtin signature), and check the signature if present. The * fsverity_descriptor must have already undergone basic validation. */ -struct fsverity_info *fsverity_create_info(const struct inode *inode, +struct fsverity_info *fsverity_create_info(struct inode *inode, struct fsverity_descriptor *desc) { struct fsverity_info *vi; @@ -242,6 +259,13 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode, spin_lock_init(&vi->hash_page_init_lock); } + err = fsverity_inode_setsecurity(inode, desc); + if (err == -EOPNOTSUPP) + err = 0; + + if (err) + goto fail; + return vi; fail: diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h index 1eb7eae580be..9666721baf15 100644 --- a/include/linux/fsverity.h +++ b/include/linux/fsverity.h @@ -319,4 +319,6 @@ static inline int fsverity_prepare_setattr(struct dentry *dentry, return 0; } +#define FS_VERITY_INODE_SEC_NAME "fsverity.builtin-sig" + #endif /* _LINUX_FSVERITY_H */