linux-kernel - Re: [PATCH v6 08/11] evm: Allow setxattr() and setattr() for unmodified metadata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1a5d2a37be31f7971374c01ed8e799e003c96f9d.camel@linux.ibm.com>
Date:   Tue, 11 May 2021 10:40:50 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Roberto Sassu <roberto.sassu@...wei.com>,
        "mjg59@...gle.com" <mjg59@...gle.com>
Cc:     "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Christian Brauner <christian.brauner@...ntu.com>,
        Andreas Gruenbacher <agruenba@...hat.com>,
        kernel test robot <lkp@...el.com>
Subject: Re: [PATCH v6 08/11] evm: Allow setxattr() and setattr() for
 unmodified metadata

On Tue, 2021-05-11 at 14:21 +0000, Roberto Sassu wrote:
> > 
> > On Wed, 2021-05-05 at 13:33 +0200, Roberto Sassu wrote:
> > > With the patch to allow xattr/attr operations if a portable signature
> > > verification fails, cp and tar can copy all xattrs/attrs so that at the
> > > end of the process verification succeeds.
> > >
> > > However, it might happen that the xattrs/attrs are already set to the
> > > correct value (taken at signing time) and signature verification succeeds
> > > before the copy has completed. For example, an archive might contains files
> > > owned by root and the archive is extracted by root.
> > >
> > > Then, since portable signatures are immutable, all subsequent operations
> > > fail (e.g. fchown()), even if the operation is legitimate (does not alter
> > > the current value).
> > >
> > > This patch avoids this problem by reporting successful operation to user
> > > space when that operation does not alter the current value of xattrs/attrs.
> > 
> > I must be missing something.  If both the IMA and EVM status flags are
> > reset after xattr or attr modification, do we really need to prevent
> > any metadata - same or different - changes?  Both evm_protect_xattr()
> > and evm_inode_setattr() would need to be modified to allow
> > INTEGRITY_PASS_IMMUTABLE.
> 
> yes, given that the IMA and EVM flags are reset, it should not be
> a problem to allow changes. However, I think it is useful to keep
> the current behavior. For example, it would prevent an accidental
> change of the SELinux label during the relabeling process.

I understand we might want to prevent accidental or malicious changes,
but that isn't the purpose of this patch set.  The patch description
would also need to be updated to reflect the real purpose.

thanks,

Mimi