lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 18 Oct 2022 17:32:40 +0200 From: Roberto Sassu <roberto.sassu@...weicloud.com> To: Christian Brauner <brauner@...nel.org>, Kees Cook <keescook@...omium.org> Cc: Mimi Zohar <zohar@...ux.ibm.com>, Dmitry Kasatkin <dmitry.kasatkin@...il.com>, Paul Moore <paul@...l-moore.com>, James Morris <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>, Petr Vorel <pvorel@...e.cz>, Jonathan McDowell <noodles@...com>, Borislav Petkov <bp@...e.de>, Takashi Iwai <tiwai@...e.de>, linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org, Mickaël Salaün <mic@...ikod.net>, KP Singh <kpsingh@...nel.org>, Casey Schaufler <casey@...aufler-ca.com>, John Johansen <john.johansen@...onical.com>, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Subject: Re: [PATCH 4/9] ima: Move ima_file_free() into LSM On Tue, 2022-10-18 at 17:02 +0200, Christian Brauner wrote: > On Thu, Oct 13, 2022 at 03:36:49PM -0700, Kees Cook wrote: > > The file_free_security hook already exists for managing > > notification of > > released files. Use the LSM hook instead of open-coded stacking. > > > > Cc: Mimi Zohar <zohar@...ux.ibm.com> > > Cc: Dmitry Kasatkin <dmitry.kasatkin@...il.com> > > Cc: Paul Moore <paul@...l-moore.com> > > Cc: James Morris <jmorris@...ei.org> > > Cc: "Serge E. Hallyn" <serge@...lyn.com> > > Cc: Petr Vorel <pvorel@...e.cz> > > Cc: Jonathan McDowell <noodles@...com> > > Cc: Borislav Petkov <bp@...e.de> > > Cc: Takashi Iwai <tiwai@...e.de> > > Cc: linux-integrity@...r.kernel.org > > Cc: linux-security-module@...r.kernel.org > > Signed-off-by: Kees Cook <keescook@...omium.org> > > --- > > fs/file_table.c | 1 - > > include/linux/ima.h | 6 ------ > > security/integrity/ima/ima_main.c | 3 ++- > > 3 files changed, 2 insertions(+), 8 deletions(-) > > > > diff --git a/fs/file_table.c b/fs/file_table.c > > index 99c6796c9f28..fa707d221a43 100644 > > --- a/fs/file_table.c > > +++ b/fs/file_table.c > > @@ -311,7 +311,6 @@ static void __fput(struct file *file) > > eventpoll_release(file); > > locks_remove_file(file); > > > > - ima_file_free(file); > > if (unlikely(file->f_flags & FASYNC)) { > > if (file->f_op->fasync) > > file->f_op->fasync(-1, file, 0); > > diff --git a/include/linux/ima.h b/include/linux/ima.h > > index 6dc5143f89f2..9f18df366064 100644 > > --- a/include/linux/ima.h > > +++ b/include/linux/ima.h > > @@ -19,7 +19,6 @@ extern enum hash_algo > > ima_get_current_hash_algo(void); > > extern int ima_file_check(struct file *file, int mask); > > extern void ima_post_create_tmpfile(struct user_namespace > > *mnt_userns, > > struct inode *inode); > > -extern void ima_file_free(struct file *file); > > extern void ima_post_path_mknod(struct user_namespace *mnt_userns, > > struct dentry *dentry); > > extern int ima_file_hash(struct file *file, char *buf, size_t > > buf_size); > > @@ -56,11 +55,6 @@ static inline void > > ima_post_create_tmpfile(struct user_namespace *mnt_userns, > > { > > } > > > > -static inline void ima_file_free(struct file *file) > > -{ > > - return; > > -} > > - > > static inline void ima_post_path_mknod(struct user_namespace > > *mnt_userns, > > struct dentry *dentry) > > { > > diff --git a/security/integrity/ima/ima_main.c > > b/security/integrity/ima/ima_main.c > > index b3b79d030a67..94379ba40b58 100644 > > --- a/security/integrity/ima/ima_main.c > > +++ b/security/integrity/ima/ima_main.c > > @@ -183,7 +183,7 @@ static void ima_check_last_writer(struct > > integrity_iint_cache *iint, > > * > > * Flag files that changed, based on i_version > > */ > > -void ima_file_free(struct file *file) > > +static void ima_file_free(struct file *file) > > { > > struct inode *inode = file_inode(file); > > struct integrity_iint_cache *iint; > > @@ -1085,6 +1085,7 @@ static struct security_hook_list ima_hooks[] > > __lsm_ro_after_init = { > > LSM_HOOK_INIT(bprm_check_security, ima_bprm_check), > > LSM_HOOK_INIT(mmap_file, ima_file_mmap), > > LSM_HOOK_INIT(file_mprotect, ima_file_mprotect), > > + LSM_HOOK_INIT(file_free_security, ima_file_free), > > This doesn't work afaict. If the file is opened for writing ima may > update xattrs. But by the time security_file_free() is called > put_file_access() has already been called which will have given up > write > access to the file's mount. > > So you would have to - just one of the possibilities - have to move > security_file_free() out of file_free() and into the old > ima_file_free() > location. But that might cause semantic changes for other LSMs. Hi I also did this work before. In my implementation, I created a new security hook called security_file_pre_free(). https://github.com/robertosassu/linux/commit/692c9d36fff865435b23b3cb765d31f3584f6263 If useful, the whole patch set is available at: https://github.com/robertosassu/linux/commits/ima-evm-lsm-v1-devel-v3 Roberto
Powered by blists - more mailing lists