linux-kernel - [PATCH v6 0/6] Add support for architecture specific IMA policies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20181009173037.32630-1-nayna@linux.vnet.ibm.com>
Date:   Tue,  9 Oct 2018 23:00:32 +0530
From:   Nayna Jain <nayna@...ux.vnet.ibm.com>
To:     linux-integrity@...r.kernel.org
Cc:     zohar@...ux.ibm.com, linux-security-module@...r.kernel.org,
        linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org,
        dhowells@...hat.com, jforbes@...hat.com,
        seth.forshee@...onical.com, pjones@...hat.com, vgoyal@...hat.com,
        dyoung@...hat.com, ebiederm@...ssion.com,
        kexec@...ts.infradead.org, Nayna Jain <nayna@...ux.ibm.com>
Subject: [PATCH v6 0/6] Add support for architecture specific IMA policies 

From: Nayna Jain <nayna@...ux.ibm.com>

The architecture specific policy, introduced in this patch set, permits
different architectures to define IMA policy rules based on kernel
configuration and system runtime information.

For example, on x86, there are two methods of verifying the kexec'ed kernel
image signature - CONFIG_KEXEC_VERIFY_SIG and IMA appraisal policy
KEXEC_KERNEL_CHECK. CONFIG_KEXEC_VERIFY_SIG enforces the kexec_file_load
syscall to verify file signatures, but does not prevent the kexec_load
syscall. The IMA KEXEC_KERNEL_CHECK policy rule verifies the kexec'ed
kernel image, loaded via the kexec_file_load syscall, is validly signed and
prevents loading a kernel image via the kexec_load syscall. When secure
boot is enabled, the kexec'ed kernel image needs to be signed and the
signature verified. In this environment, either method of verifying the
kexec'ed kernel image is acceptable, as long as the kexec_load syscall is
disabled.

The previous version of this patchset introduced a new IMA policy rule to
disable the kexec_load syscall, when CONFIG_KEXEC_VERIFY_SIG was enabled,
however that is removed from this version by introducing a different
mechanism, as described below.

The patchset defines an arch_ima_get_secureboot() function to retrieve the
secureboot state of the system. If secureboot is enabled and
CONFIG_KEXEC_VERIFY_SIG is configured, it denies permission to kexec_load
syscall.

To support architecture specific policies, a new function
arch_get_ima_policy() is defined. This patch set defines IMA
KERNEL_KEXEC_POLICY rules for x86 *only* if CONFIG_KEXEC_VERIFY_SIG is
disabled and secure boot is enabled.

This patch set includes a patch, which refactors ima_init_policy() to
remove code duplication.

Changelog:

v6:
* ima: prevent kexec_load syscall based on runtime secureboot flag
	- Includes Mimi's feedback - replace #ifdef with IS_ENABLED
	in .c file
* ima: add support for arch specific policies
	- Fixed one line exceeding 80 character's warning
* x86/ima: define arch_get_ima_policy() for x86
	- Includes Mimi's feedback - replace #ifdef with IS_ENABLED
	in .c file and fixed a comment

v5:

* ima: refactor ima_init_policy()
	- Includes Mimi's feedback - updated patch description, and
	code fixes. 
* ima: add support for arch specific policies
	- Includes Mimi's feedback - updated comment.
* ima: add support for external setting of ima_appraise
	- Includes Mimi's feedback - This patch is deleted. This is
	handled by enabling IMA_APPRAISE_BOOTPARAM only if IMA_ARCH_POLICY
	is not enabled. The change is done in the Patch 5/5.

v4:
* ima: refactor ima_init_policy()
	- Fixed the issue reported by Dan Carpenter. Replaced logical
	operator (&&) with bitwise operator (&).

v3:
* x86/ima: define arch_ima_get_secureboot
	- Edited subject line, added x86.

* x86/ima: define arch_get_ima_policy() for x86
	- Fixed the error reported by kbuild test robot. The error was
	appearing when CONFIG_X86 is enabled, but CONFIG_IMA_ARCH_POLICY
	is disabled.

v2:
* ima: define arch_ima_get_secureboot
	- New Patch - to retrieve secureboot state of the system
* ima: prevent kexec_load syscall based on runtime secureboot flag
	- New Patch - disables kexec_load if KEXEC_VERIFY_SIG is
	  configured and secureboot is enabled
* ima: refactor ima_init_policy()
	- New Patch - cleans up the code duplication in
	  ima_init_policy(), adds new function add_rules()
* ima: add support for arch specific policies
	- modified ima_init_arch_policy() and ima_init_policy() to
	  use add_rules() from previous patch.
* ima: add support for external setting of ima_appraise
	- sets ima_appraise flag explicitly for arch_specific setting
* ima: add support for KEXEC_ORIG_KERNEL_CHECK
	- deleted the patch based on Seth's feedback
* x86/ima: define arch_get_ima_policy() for x86
	- removes the policy KEXEC_ORIG_KERNEL_CHECK based on
	  Seth's feedback.

Eric Richter (1):
  x86/ima: define arch_get_ima_policy() for x86

Nayna Jain (4):
  x86/ima: define arch_ima_get_secureboot
  ima: prevent kexec_load syscall based on runtime secureboot flag
  ima: refactor ima_init_policy()
  ima: add support for arch specific policies

 arch/x86/kernel/Makefile            |   2 +
 arch/x86/kernel/ima_arch.c          |  33 +++++++
 include/linux/ima.h                 |  15 ++++
 security/integrity/ima/Kconfig      |  10 ++-
 security/integrity/ima/ima_main.c   |  17 ++--
 security/integrity/ima/ima_policy.c | 167 +++++++++++++++++++++++++++---------
 6 files changed, 195 insertions(+), 49 deletions(-)
 create mode 100644 arch/x86/kernel/ima_arch.c

-- 
2.13.6