| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <a811e4dda817d7a01f39b14ffa16a484@paul-moore.com>
Date: Mon, 01 Apr 2024 21:26:44 -0400
From: Paul Moore <paul@...l-moore.com>
To: Fan Wu <wufan@...ux.microsoft.com>, corbet@....net, zohar@...ux.ibm.com, jmorris@...ei.org, serge@...lyn.com, tytso@....edu, ebiggers@...nel.org, axboe@...nel.dk, agk@...hat.com, snitzer@...nel.org, eparis@...hat.com
Cc: linux-doc@...r.kernel.org, linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org, fsverity@...ts.linux.dev, linux-block@...r.kernel.org, dm-devel@...ts.linux.dev, audit@...r.kernel.org, linux-kernel@...r.kernel.org, Deven Bowers <deven.desai@...ux.microsoft.com>, Fan Wu <wufan@...ux.microsoft.com>
Subject: Re: [PATCH v16 14/20] ipe: add support for dm-verity as a trust provider
On Mar 28, 2024 Fan Wu <wufan@...ux.microsoft.com> wrote:
>
> Allows author of IPE policy to indicate trust for a singular dm-verity
> volume, identified by roothash, through "dmverity_roothash" and all
> signed dm-verity volumes, through "dmverity_signature".
>
> Signed-off-by: Deven Bowers <deven.desai@...ux.microsoft.com>
> Signed-off-by: Fan Wu <wufan@...ux.microsoft.com>
> ---
> v2:
> + No Changes
>
> v3:
> + No changes
>
> v4:
> + No changes
>
> v5:
> + No changes
>
> v6:
> + Fix an improper cleanup that can result in
> a leak
>
> v7:
> + Squash patch 08/12, 10/12 to [11/16]
>
> v8:
> + Undo squash of 08/12, 10/12 - separating drivers/md/ from security/
> & block/
> + Use common-audit function for dmverity_signature.
> + Change implementation for storing the dm-verity digest to use the
> newly introduced dm_verity_digest structure introduced in patch
> 14/20.
>
> v9:
> + Adapt to the new parser
>
> v10:
> + Select the Kconfig when all dependencies are enabled
>
> v11:
> + No changes
>
> v12:
> + Refactor to use struct digest_info* instead of void*
> + Correct audit format
>
> v13:
> + Remove the CONFIG_IPE_PROP_DM_VERITY dependency inside the parser
> to make the policy grammar independent of the kernel config.
>
> v14:
> + No changes
>
> v15:
> + Fix one grammar issue in KCONFIG
> + Switch to use security_bdev_setintegrity() hook
>
> v16:
> + Refactor for enum integrity type
> ---
> security/ipe/Kconfig | 18 ++++++
> security/ipe/Makefile | 1 +
> security/ipe/audit.c | 29 ++++++++-
> security/ipe/digest.c | 120 +++++++++++++++++++++++++++++++++++
> security/ipe/digest.h | 26 ++++++++
> security/ipe/eval.c | 91 +++++++++++++++++++++++++-
> security/ipe/eval.h | 10 +++
> security/ipe/hooks.c | 72 +++++++++++++++++++++
> security/ipe/hooks.h | 8 +++
> security/ipe/ipe.c | 15 +++++
> security/ipe/ipe.h | 4 ++
> security/ipe/policy.h | 3 +
> security/ipe/policy_parser.c | 24 ++++++-
> 13 files changed, 417 insertions(+), 4 deletions(-)
> create mode 100644 security/ipe/digest.c
> create mode 100644 security/ipe/digest.h
..
> diff --git a/security/ipe/hooks.c b/security/ipe/hooks.c
> index 6bcc7908ed13..f95986a87d51 100644
> --- a/security/ipe/hooks.c
> +++ b/security/ipe/hooks.c
> @@ -187,3 +191,71 @@ void ipe_unpack_initramfs(void)
> {
> ipe_sb(current->fs->root.mnt->mnt_sb)->initramfs = true;
> }
> +
> +#ifdef CONFIG_IPE_PROP_DM_VERITY
> +/**
> + * ipe_bdev_free_security - free IPE's LSM blob of block_devices.
> + * @bdev: Supplies a pointer to a block_device that contains the structure
> + * to free.
> + */
> +void ipe_bdev_free_security(struct block_device *bdev)
> +{
> + struct ipe_bdev *blob = ipe_bdev(bdev);
> +
> + ipe_digest_free(blob->root_hash);
> +}
> +
> +/**
> + * ipe_bdev_setintegrity - save integrity data from a bdev to IPE's LSM blob.
> + * @bdev: Supplies a pointer to a block_device that contains the LSM blob.
> + * @type: Supplies the integrity type.
> + * @value: Supplies the value to store.
> + * @size: The size of @value.
> + */
> +int ipe_bdev_setintegrity(struct block_device *bdev, enum lsm_integrity_type type,
> + const void *value, size_t size)
> +{
> + struct ipe_bdev *blob = ipe_bdev(bdev);
> +
> + if (type == LSM_INT_DMVERITY_ROOTHASH) {
> + if (!value) {
> + ipe_digest_free(blob->root_hash);
> + blob->root_hash = NULL;
> +
> + return 0;
> + }
> +
> + const struct dm_verity_digest *digest = value;
> + struct digest_info *info = NULL;
General kernel coding conventions put variable declarations at the top
of the scope; in other words, move the '!value' if-statement below
this.
> + info = kzalloc(sizeof(*info), GFP_KERNEL);
> + if (!info)
> + return -ENOMEM;
> +
> + info->digest_len = digest->digest_len;
> +
> + info->digest = kmemdup(digest->digest, info->digest_len,
> + GFP_KERNEL);
> + if (!info->digest)
> + goto err;
It's always a good practice to not do any work you might not need to
do in case of error:
info->digest = kmemdup(...);
if (!info->digest)
goto dmv_roothash_err;
info->digest_len = digest->digest_len;
> + info->alg = kstrdup(digest->alg, GFP_KERNEL);
> + if (!info->alg)
> + goto err;
> +
> + blob->root_hash = info;
> +
> + return 0;
> +err:
You might want to consider naming this 'dmv_roothash_err' to help
indicate that it is a jump label specifically for use within the
DMVERITY_ROOTHASH block.
> + ipe_digest_free(info);
> +
> + return -ENOMEM;
> + } else if (type == LSM_INT_DMVERITY_SIG) {
> + blob->dm_verity_signed = size > 0 && value;
> +
> + return 0;
> + }
Woule it be worth returning -EINVAL if some other lsm_integrity_type
value was used here?
if (ROOTHASH) {
...
} else if (SIG) {
...
} else
return -EINVAL;
> + return 0;
> +}
> +#endif /* CONFIG_IPE_PROP_DM_VERITY */
--
paul-moore.com
Powered by blists - more mailing lists