| Message ID | 1687986571-16823-10-git-send-email-wufan@linux.microsoft.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | Integrity Policy Enforcement LSM (IPE) | expand |
On Jun 28, 2023 Fan Wu <wufan@linux.microsoft.com> wrote: > > IPE, like SELinux, supports a permissive mode. This mode allows policy > authors to test and evaluate IPE policy without it effecting their > programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS > be reported. > > This patch adds the following audit records: > > audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295 > ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 > audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295 > ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 > > The audit record only emit when the value from the user input is > different from the current enforce value. > > Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com> > Signed-off-by: Fan Wu <wufan@linux.microsoft.com> > --- > security/ipe/audit.c | 22 ++++++++++++++ > security/ipe/audit.h | 1 + > security/ipe/eval.c | 9 ++++++ > security/ipe/eval.h | 1 + > security/ipe/fs.c | 69 ++++++++++++++++++++++++++++++++++++++++++++ > 5 files changed, 102 insertions(+) ... > diff --git a/security/ipe/fs.c b/security/ipe/fs.c > index 6bd2aa84831b..1761d39e4d04 100644 > --- a/security/ipe/fs.c > +++ b/security/ipe/fs.c > @@ -16,6 +16,7 @@ static struct dentry *np __ro_after_init; > static struct dentry *root __ro_after_init; > struct dentry *policy_root __ro_after_init; > static struct dentry *audit_node __ro_after_init; > +static struct dentry *enforce_node __ro_after_init; > > /** > * setaudit - Write handler for the securityfs node, "ipe/success_audit" > @@ -68,6 +69,61 @@ static ssize_t getaudit(struct file *f, char __user *data, > return simple_read_from_buffer(data, len, offset, result, 1); > } > > +/** > + * setenforce - Write handler for the securityfs node, "ipe/enforce" > + * @f: Supplies a file structure representing the securityfs node. > + * @data: Supplies a buffer passed to the write syscall. > + * @len: Supplies the length of @data. > + * @offset: unused. > + * > + * Return: > + * * >0 - Success, Length of buffer written > + * * <0 - Error > + */ > +static ssize_t setenforce(struct file *f, const char __user *data, > + size_t len, loff_t *offset) > +{ > + int rc = 0; > + bool new_value, old_value; > + > + if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) > + return -EPERM; > + > + old_value = READ_ONCE(enforce); > + new_value = old_value; Why set @new_value equal to @old_value here? > + rc = kstrtobool_from_user(data, len, &new_value); > + if (rc) > + return rc; > + > + if (new_value != old_value) { > + ipe_audit_enforce(new_value, old_value); > + WRITE_ONCE(enforce, new_value); > + } > + > + return len; > +} -- paul-moore.com
On Sat, Jul 08, 2023 at 12:23:06AM -0400, Paul Moore wrote: > On Jun 28, 2023 Fan Wu <wufan@linux.microsoft.com> wrote: > > > > IPE, like SELinux, supports a permissive mode. This mode allows policy > > authors to test and evaluate IPE policy without it effecting their > > programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS > > be reported. > > > > This patch adds the following audit records: > > > > audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295 > > ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 > > audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295 > > ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 > > > > The audit record only emit when the value from the user input is > > different from the current enforce value. > > > > Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com> > > Signed-off-by: Fan Wu <wufan@linux.microsoft.com> > > --- > > security/ipe/audit.c | 22 ++++++++++++++ > > security/ipe/audit.h | 1 + > > security/ipe/eval.c | 9 ++++++ > > security/ipe/eval.h | 1 + > > security/ipe/fs.c | 69 ++++++++++++++++++++++++++++++++++++++++++++ > > 5 files changed, 102 insertions(+) > > ... > > > diff --git a/security/ipe/fs.c b/security/ipe/fs.c > > index 6bd2aa84831b..1761d39e4d04 100644 > > --- a/security/ipe/fs.c > > +++ b/security/ipe/fs.c > > @@ -16,6 +16,7 @@ static struct dentry *np __ro_after_init; > > static struct dentry *root __ro_after_init; > > struct dentry *policy_root __ro_after_init; > > static struct dentry *audit_node __ro_after_init; > > +static struct dentry *enforce_node __ro_after_init; > > > > /** > > * setaudit - Write handler for the securityfs node, "ipe/success_audit" > > @@ -68,6 +69,61 @@ static ssize_t getaudit(struct file *f, char __user *data, > > return simple_read_from_buffer(data, len, offset, result, 1); > > } > > > > +/** > > + * setenforce - Write handler for the securityfs node, "ipe/enforce" > > + * @f: Supplies a file structure representing the securityfs node. > > + * @data: Supplies a buffer passed to the write syscall. > > + * @len: Supplies the length of @data. > > + * @offset: unused. > > + * > > + * Return: > > + * * >0 - Success, Length of buffer written > > + * * <0 - Error > > + */ > > +static ssize_t setenforce(struct file *f, const char __user *data, > > + size_t len, loff_t *offset) > > +{ > > + int rc = 0; > > + bool new_value, old_value; > > + > > + if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) > > + return -EPERM; > > + > > + old_value = READ_ONCE(enforce); > > + new_value = old_value; > > Why set @new_value equal to @old_value here? > Sorry this mistake is the same as the one for audit switch. kstrtobool_from_user will return error if new_value is not set, I will remove the above line. -Fan > > + rc = kstrtobool_from_user(data, len, &new_value); > > + if (rc) > > + return rc; > > + > > + if (new_value != old_value) { > > + ipe_audit_enforce(new_value, old_value); > > + WRITE_ONCE(enforce, new_value); > > + } > > + > > + return len; > > +} > > -- > paul-moore.com
diff --git a/security/ipe/audit.c b/security/ipe/audit.c index d3f78a7fc93f..08f855f70f76 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -195,3 +195,25 @@ void ipe_audit_policy_load(const struct ipe_policy *const p) audit_log_end(ab); } + +/** + * ipe_audit_enforce - Audit a change in IPE's enforcement state. + * @new_enforce: The new value enforce to be set. + * @old_enforce: The old value currently in enforce. + */ +void ipe_audit_enforce(bool new_enforce, bool old_enforce) +{ + struct audit_buffer *ab; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS); + if (!ab) + return; + + audit_log_format(ab, "enforcing=%d old_enforcing=%d auid=%u ses=%u" + " enabled=1 old-enabled=1 lsm=ipe res=1", + new_enforce, old_enforce, + from_kuid(&init_user_ns, audit_get_loginuid(current)), + audit_get_sessionid(current)); + + audit_log_end(ab); +} diff --git a/security/ipe/audit.h b/security/ipe/audit.h index 0ff5a06808de..914f001e5286 100644 --- a/security/ipe/audit.h +++ b/security/ipe/audit.h @@ -14,5 +14,6 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx, void ipe_audit_policy_load(const struct ipe_policy *const p); void ipe_audit_policy_activation(const struct ipe_policy *const op, const struct ipe_policy *const np); +void ipe_audit_enforce(bool new_enforce, bool old_enforce); #endif /* _IPE_AUDIT_H */ diff --git a/security/ipe/eval.c b/security/ipe/eval.c index 2cb43ad92a65..2d4b3a6d7b7a 100644 --- a/security/ipe/eval.c +++ b/security/ipe/eval.c @@ -20,6 +20,7 @@ struct ipe_policy __rcu *ipe_active_policy; bool success_audit; +bool enforce = true; static const struct super_block *pinned_sb; static DEFINE_SPINLOCK(pin_lock); @@ -116,6 +117,7 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) { int rc = 0; bool match = false; + bool enforcing = true; enum ipe_action_type action; enum ipe_match match_type; struct ipe_policy *pol = NULL; @@ -131,6 +133,8 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) return 0; } + enforcing = READ_ONCE(enforce); + if (ctx->op == __IPE_OP_INVALID) { action = pol->parsed->global_default_action; match_type = __IPE_MATCH_GLOBAL; @@ -167,6 +171,9 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) if (action == __IPE_ACTION_DENY) rc = -EACCES; + if (!enforcing) + rc = 0; + return rc; } @@ -196,3 +203,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb) module_param(success_audit, bool, 0400); MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled"); +module_param(enforce, bool, 0400); +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode"); diff --git a/security/ipe/eval.h b/security/ipe/eval.h index 8fcdb2ea19f4..15c35921fd4d 100644 --- a/security/ipe/eval.h +++ b/security/ipe/eval.h @@ -14,6 +14,7 @@ extern struct ipe_policy __rcu *ipe_active_policy; extern bool success_audit; +extern bool enforce; struct ipe_eval_ctx { enum ipe_op_type op; diff --git a/security/ipe/fs.c b/security/ipe/fs.c index 6bd2aa84831b..1761d39e4d04 100644 --- a/security/ipe/fs.c +++ b/security/ipe/fs.c @@ -16,6 +16,7 @@ static struct dentry *np __ro_after_init; static struct dentry *root __ro_after_init; struct dentry *policy_root __ro_after_init; static struct dentry *audit_node __ro_after_init; +static struct dentry *enforce_node __ro_after_init; /** * setaudit - Write handler for the securityfs node, "ipe/success_audit" @@ -68,6 +69,61 @@ static ssize_t getaudit(struct file *f, char __user *data, return simple_read_from_buffer(data, len, offset, result, 1); } +/** + * setenforce - Write handler for the securityfs node, "ipe/enforce" + * @f: Supplies a file structure representing the securityfs node. + * @data: Supplies a buffer passed to the write syscall. + * @len: Supplies the length of @data. + * @offset: unused. + * + * Return: + * * >0 - Success, Length of buffer written + * * <0 - Error + */ +static ssize_t setenforce(struct file *f, const char __user *data, + size_t len, loff_t *offset) +{ + int rc = 0; + bool new_value, old_value; + + if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) + return -EPERM; + + old_value = READ_ONCE(enforce); + new_value = old_value; + rc = kstrtobool_from_user(data, len, &new_value); + if (rc) + return rc; + + if (new_value != old_value) { + ipe_audit_enforce(new_value, old_value); + WRITE_ONCE(enforce, new_value); + } + + return len; +} + +/** + * getenforce - Read handler for the securityfs node, "ipe/enforce" + * @f: Supplies a file structure representing the securityfs node. + * @data: Supplies a buffer passed to the read syscall. + * @len: Supplies the length of @data. + * @offset: unused. + * + * Return: + * * >0 - Success, Length of buffer written + * * <0 - Error + */ +static ssize_t getenforce(struct file *f, char __user *data, + size_t len, loff_t *offset) +{ + const char *result; + + result = ((READ_ONCE(enforce)) ? "1" : "0"); + + return simple_read_from_buffer(data, len, offset, result, 1); +} + /** * new_policy - Write handler for the securityfs node, "ipe/new_policy". * @f: Supplies a file structure representing the securityfs node. @@ -121,6 +177,11 @@ static const struct file_operations audit_fops = { .read = getaudit, }; +static const struct file_operations enforce_fops = { + .write = setenforce, + .read = getenforce, +}; + /** * ipe_init_securityfs - Initialize IPE's securityfs tree at fsinit. * @@ -148,6 +209,13 @@ static int __init ipe_init_securityfs(void) goto err; } + enforce_node = securityfs_create_file("enforce", 0600, root, NULL, + &enforce_fops); + if (IS_ERR(enforce_node)) { + rc = PTR_ERR(enforce_node); + goto err; + } + policy_root = securityfs_create_dir("policies", root); if (IS_ERR(policy_root)) { rc = PTR_ERR(policy_root); @@ -164,6 +232,7 @@ static int __init ipe_init_securityfs(void) err: securityfs_remove(np); securityfs_remove(policy_root); + securityfs_remove(enforce_node); securityfs_remove(audit_node); securityfs_remove(root); return rc;