linux-kernel - Re: [PATCH 2/3] binfmt_elf: Verify signature of signed elf binary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Jan 2013 19:03:51 +0200
From:	"Kasatkin, Dmitry" <dmitry.kasatkin@...el.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	Vivek Goyal <vgoyal@...hat.com>, linux-kernel@...r.kernel.org,
	ebiederm@...ssion.com, pjones@...hat.com, hpa@...or.com,
	dhowells@...hat.com, jwboyer@...hat.com
Subject: Re: [PATCH 2/3] binfmt_elf: Verify signature of signed elf binary

Hello.

This is just a quick-patch for IMA to lock digitally signed binaries
in similar manner as the patch of this thread does...

No policy here. No optimization here. Just tests if binary has signature.
Rather simple.

- Dmitry


On Thu, Jan 17, 2013 at 7:01 PM, Kasatkin, Dmitry
<dmitry.kasatkin@...el.com> wrote:
> commit f6bf2c4c0339dabac435f518bb1fcb617fdef8f1
> Author: Dmitry Kasatkin <dmitry.kasatkin@...el.com>
> Date:   Thu Jan 17 18:50:43 2013 +0200
>
>     ima: lock down memory if binary is digitally signed
>
>     This patch set a flag in the linux_binprm structure if binary is
>     digitally signed. The flag is used to lock down memory when loading
>     ELF binary.
>
>     Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@...el.com>
>
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 0c42cdb..ba94d13 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -44,6 +44,8 @@
>  #define user_siginfo_t siginfo_t
>  #endif
>
> +#define LSM_UNSAFE_DIGSIG      16
> +
>  static int load_elf_binary(struct linux_binprm *bprm);
>  static int load_elf_library(struct file *);
>  static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
> @@ -788,6 +790,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
>
>                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
>
> +               if (bprm->unsafe & LSM_UNSAFE_DIGSIG)
> +                       elf_flags |= MAP_LOCKED;
> +
>                 vaddr = elf_ppnt->p_vaddr;
>                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
>                         elf_flags |= MAP_FIXED;
> diff --git a/security/integrity/ima/ima_main.c
> b/security/integrity/ima/ima_main.c
> index b359fb5..50d9959 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -27,6 +27,8 @@
>
>  #include "ima.h"
>
> +#define LSM_UNSAFE_DIGSIG      16
> +
>  int ima_initialized;
>
>  #ifdef CONFIG_IMA_APPRAISE
> @@ -315,10 +317,19 @@ int ima_file_mmap(struct file *file, unsigned long prot)
>   */
>  int ima_bprm_check(struct linux_binprm *bprm)
>  {
> -       return process_measurement(bprm->file,
> +       int err;
> +       struct integrity_iint_cache *iint;
> +
> +       err = process_measurement(bprm->file,
>                                  (strcmp(bprm->filename, bprm->interp) == 0) ?
>                                  bprm->filename : bprm->interp,
>                                  MAY_EXEC, BPRM_CHECK);
> +
> +       iint = integrity_iint_find(bprm->file->f_dentry->d_inode);
> +       if (iint && (iint->flags & IMA_DIGSIG))
> +               bprm->unsafe |= LSM_UNSAFE_DIGSIG;
> +
> +       return err;
>  }
>
>  /**
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/