linux-kernel - Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <191ABC6C-1F0C-4B12-8785-C0548251ADDD@fb.com>
Date: Wed, 18 Dec 2024 06:41:54 +0000
From: Song Liu <songliubraving@...a.com>
To: Song Liu <songliubraving@...a.com>,
        "roberto.sassu@...wei.com"
	<roberto.sassu@...wei.com>
CC: Paul Moore <paul@...l-moore.com>,
        Casey Schaufler
	<casey@...aufler-ca.com>, Song Liu <song@...nel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org"
	<linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "dmitry.kasatkin@...il.com"
	<dmitry.kasatkin@...il.com>,
        "eric.snowberg@...cle.com"
	<eric.snowberg@...cle.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com" <serge@...lyn.com>,
        Kernel Team <kernel-team@...a.com>,
        "brauner@...nel.org" <brauner@...nel.org>,
        "jack@...e.cz" <jack@...e.cz>,
        "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>
Subject: Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM


> On Dec 17, 2024, at 3:33 PM, Song Liu <songliubraving@...a.com> wrote:

[...]

> 
>>> +
>>>                               found = true;
>>>                       }
>>>               }
>>> @@ -386,7 +389,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>>> 
>>>       /* LSM_ORDER_LAST is always last. */
>>>       for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
>>> -               if (lsm->order == LSM_ORDER_LAST)
>>> +               if (lsm->order == LSM_ORDER_LAST && is_enabled(lsm))
>>>                       append_ordered_lsm(lsm, "   last");
> 
> Before this change, lsm with order==LSM_ORDER_LAST is always considered
> enabled, which is a bug (if I understand you and Casey correctly).

According to commit 42994ee3cd7298b27698daa6848ed7168e72d056, LSMs with 
order LSM_ORDER_LAST is expected to be always enabled:

"Similarly to LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled
and put at the end of the LSM list, if selected in the kernel
configuration. "

Roberto, it feels weird to have two "last and always on" LSMs (ima and evm)
I guess this is not the expected behavior? At least, it appears to be a
surprise for Paul and Casey. 

I will send patch that allow enable/disable ima and evm with lsm= cmdline.
We can further discuss the topic with the patch. 

Thanks,
Song