linux-kernel - Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B1D93B7E-7595-4B84-BC41-298067EAC8DC@fb.com>
Date: Tue, 17 Dec 2024 22:47:13 +0000
From: Song Liu <songliubraving@...a.com>
To: Song Liu <songliubraving@...a.com>
CC: Paul Moore <paul@...l-moore.com>,
        Casey Schaufler
	<casey@...aufler-ca.com>, Song Liu <song@...nel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org"
	<linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "roberto.sassu@...wei.com"
	<roberto.sassu@...wei.com>,
        "dmitry.kasatkin@...il.com"
	<dmitry.kasatkin@...il.com>,
        "eric.snowberg@...cle.com"
	<eric.snowberg@...cle.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com" <serge@...lyn.com>,
        Kernel Team <kernel-team@...a.com>,
        "brauner@...nel.org" <brauner@...nel.org>,
        "jack@...e.cz" <jack@...e.cz>,
        "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>
Subject: Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM



> On Dec 17, 2024, at 2:04 PM, Song Liu <songliubraving@...a.com> wrote:
> 
> 
> 
>> On Dec 17, 2024, at 1:59 PM, Paul Moore <paul@...l-moore.com> wrote:
>> 
>> On Tue, Dec 17, 2024 at 4:29 PM Casey Schaufler <casey@...aufler-ca.com> wrote:
>>> On 12/17/2024 12:25 PM, Song Liu wrote:
>>>> While reading and testing LSM code, I found IMA/EVM consume per inode
>>>> storage even when they are not in use. Add options to diable them in
>>>> kernel command line. The logic and syntax is mostly borrowed from an
>>>> old serious [1].
>>> 
>>> Why not omit ima and evm from the lsm= parameter?
>> 
>> Exactly.  Here is a link to the kernel documentation if anyone is
>> interested (search for "lsm"):
>> 
>> https://docs.kernel.org/admin-guide/kernel-parameters.html
>> 
>> It is worth mentioning that this works for all the LSMs.
> 
> I guess this is a bug that ima and evm do cannot be disabled
> by (not being add to) lsm= parameter?

If we use lsm= to control ima and evm, we will need the following
changes in ordered_lsm_parse(). We still need supporting logic
in ima and evm side, so that ima and evm are only initialized 
when they are in lsm=.  

Does this sound the right way forward?

Thanks,
Song





diff --git i/security/security.c w/security/security.c
index 09664e09fec9..00271be3b0c1 100644
--- i/security/security.c
+++ w/security/security.c
@@ -365,6 +365,9 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
                        if (strcmp(lsm->name, name) == 0) {
                                if (lsm->order == LSM_ORDER_MUTABLE)
                                        append_ordered_lsm(lsm, origin);
+                               else if (lsm->order == LSM_ORDER_LAST)
+                                       set_enabled(lsm, true);
+
                                found = true;
                        }
                }
@@ -386,7 +389,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)

        /* LSM_ORDER_LAST is always last. */
        for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
-               if (lsm->order == LSM_ORDER_LAST)
+               if (lsm->order == LSM_ORDER_LAST && is_enabled(lsm))
                        append_ordered_lsm(lsm, "   last");
        }