linux-kernel - Re: [PATCH 3/4] module: Support to show the current enforcement policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180307201408.ssuzsmbatntk67yz@redbean>
Date:   Wed, 7 Mar 2018 21:14:11 +0100
From:   Jessica Yu <jeyu@...nel.org>
To:     Jia Zhang <zhang.jia@...ux.alibaba.com>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/4] module: Support to show the current enforcement
 policy

+++ Jia Zhang [01/03/18 17:09 +0800]:
>/sys/kernel/security/modsign/enforce gives the result of current
>enforcement policy of loading module.
>
>Signed-off-by: Jia Zhang <zhang.jia@...ux.alibaba.com>

Why is this being added as part of securityfs? AFAIK that's primarily used by LSMs.

And we already export sig_enforce to sysfs (See /sys/module/module/parameters/sig_enforce).
It already does exactly what your patchset tries to do, it only allows for enablement. 

Jessica

>---
> kernel/module.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 55 insertions(+)
>
>diff --git a/kernel/module.c b/kernel/module.c
>index 79825ea..e3c6c8e 100644
>--- a/kernel/module.c
>+++ b/kernel/module.c
>@@ -2794,11 +2794,60 @@ static int module_sig_check(struct load_info *info, int flags)
>
> 	return err;
> }
>+
>+#ifdef CONFIG_SECURITYFS
>+static ssize_t modsign_enforce_read(struct file *filp, char __user *ubuf,
>+				    size_t count, loff_t *offp)
>+{
>+	char buf[2];
>+
>+	sprintf(buf, "%d", !!sig_enforce);
>+
>+	return simple_read_from_buffer(ubuf, count, offp, buf, 1);
>+}
>+
>+static const struct file_operations modsign_enforce_ops = {
>+	.read = modsign_enforce_read,
>+	.llseek = generic_file_llseek,
>+};
>+
>+static int __init securityfs_init(void)
>+{
>+	struct dentry *modsign_dir;
>+	struct dentry *enforce;
>+
>+	modsign_dir = securityfs_create_dir("modsign", NULL);
>+	if (IS_ERR(modsign_dir))
>+		return -1;
>+
>+	enforce = securityfs_create_file("enforce",
>+					 S_IRUSR | S_IRGRP, modsign_dir,
>+					 NULL, &modsign_enforce_ops);
>+	if (IS_ERR(enforce))
>+		goto out;
>+
>+	return 0;
>+out:
>+	securityfs_remove(modsign_dir);
>+
>+	return -1;
>+}
>+#else /* !CONFIG_SECURITYFS */
>+static int __init securityfs_init(void)
>+{
>+	return 0;
>+}
>+#endif
> #else /* !CONFIG_MODULE_SIG */
> static int module_sig_check(struct load_info *info, int flags)
> {
> 	return 0;
> }
>+
>+static int __init securityfs_init(void)
>+{
>+	return 0;
>+}
> #endif /* !CONFIG_MODULE_SIG */
>
> /* Sanity checks against invalid binaries, wrong arch, weird elf version. */
>@@ -4395,8 +4444,14 @@ void module_layout(struct module *mod,
>
> static int __init initialize_module(void)
> {
>+	int ret;
>+
> 	proc_modules_init();
>
>+	ret = securityfs_init();
>+	if (unlikely(ret))
>+		return ret;
>+
> 	return 0;
> }
> module_init(initialize_module);
>-- 
>1.8.3.1
>