From patchwork Wed Nov 7 11:16:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Bobrowski X-Patchwork-Id: 10672191 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4FF3514D6 for ; Wed, 7 Nov 2018 11:16:34 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3ED282AC94 for ; Wed, 7 Nov 2018 11:16:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 328592AC97; Wed, 7 Nov 2018 11:16:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0D6942AC96 for ; Wed, 7 Nov 2018 11:16:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726386AbeKGUq0 (ORCPT ); Wed, 7 Nov 2018 15:46:26 -0500 Received: from mail-pg1-f195.google.com ([209.85.215.195]:40699 "EHLO mail-pg1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726361AbeKGUq0 (ORCPT ); Wed, 7 Nov 2018 15:46:26 -0500 Received: by mail-pg1-f195.google.com with SMTP id z10so5331145pgp.7 for ; Wed, 07 Nov 2018 03:16:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mbobrowski-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=wwjftgqpJDMARQfok7odA7l7h/HuwDR5ecKkUYHGIDg=; b=Tas9DHYunv12PyPUjpuefwuXJBRclzg9+ATluKSVm2Vu4dMWAMV3d/q2U4f+R27Hju Q12kbDqT8EIAFr7jDpXGdY3Ju9Y1EHpEVEaC7jL6MMzX8xKSsTywYHJ+FpfbF2WL8MrP 8gykCAjrktuzw+dRph2Jr+NoKD3N51DRIvTbKFDJ+WViF+vOxPkOI4Ojo9BU1z/DJh6U jUfRZACZlg/ouscB0wJ4k/sXmQXeZnNU7YOul/mZ3dxj9px4BetPbcOf8ImLgjwi5C/t hQPgvVcNNUkD1yWVhkzrGC786PL+A0kVkpkvX9NH37u4igEhNxiGPFcN2mGXDo5K+qtF Zx1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=wwjftgqpJDMARQfok7odA7l7h/HuwDR5ecKkUYHGIDg=; b=spbeOSkJ7lDASYfJrPp+dMoetuC37HYM+vb48jxEY+GK2TAjd2zD/i6Te7YAg36mAW x9zfG1HSXu0ZLGECptF6td3Ktw68pqoYIqiPn7xRl1bgyfEa/EvdZ6eXhq4xGIOALAyq fAPI8YXx1kMW0tineVeEPHHk0DBgBJUnbtWhNTP0pwyucV8n0KRCA5T+DTNtZLJke/9u LhZQv9WjLIui76co83FdtRgE1MOQErVv4t8Nbws9cmBXQXGU/F1jWGpyrtRAAE8Ms5LP mYXj5ZJ6290iwkIYv24Vy2JHgWl/QYx73vM6ay3bfLcca4wEYCsQMXmlDoxHjpLB5G2p g7lg== X-Gm-Message-State: AGRZ1gJvxmSOb37nZNXF+Da4D61pS2Xe+IHoRb4UVB0RYKi4TCwdpNzB 4TzwiMAMv+FJKY3JOsMbd7S0 X-Google-Smtp-Source: AJdET5cVIt3axouJtN0gWwokoTCozk3Gic8yLIgehVrBK1oJMA+OWh2FnWjEGUFG31yJO9XpjcoHdA== X-Received: by 2002:a63:e70a:: with SMTP id b10-v6mr1128113pgi.363.1541589390549; Wed, 07 Nov 2018 03:16:30 -0800 (PST) Received: from workstation.internal.lab (n114-74-18-206.sbr2.nsw.optusnet.com.au. [114.74.18.206]) by smtp.gmail.com with ESMTPSA id k75-v6sm1217664pfb.119.2018.11.07.03.16.27 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 07 Nov 2018 03:16:29 -0800 (PST) Date: Wed, 7 Nov 2018 22:16:24 +1100 From: Matthew Bobrowski To: jack@suse.cz Cc: amir73il@gmail.com, linux-api@vger.kernel.org, sgrubb@redhat.com, linux-fsdevel@vger.kernel.org Subject: [PATCH v6 0/4] fanotify: introduce new event masks FAN_OPEN_EXEC and FAN_OPEN_EXEC_PERM Message-ID: MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently, the fanotify API does not provide a means for user space applications to receive events when a file has been opened specifically for execution. New event masks FAN_OPEN_EXEC and FAN_OPEN_EXEC_PERM have been introduced in order to provide users with this capability. These event types, when either are explicitly requested by the user, will be returned within the event mask when a marked file object is being opened has __FMODE_EXEC set as one of the flags for open_flag. Linux is used as an operating system in some products, with an environment that can be certified under the Common Criteria Operating System Protection Profile (OSPP). This is a formal threat model for a class of technology. It requires specific countermeasures to mitigate threats. It requires documentation to explain how a product implements these countermeasures. It requires proof via a test suite to demonstrate that the requirements are met, observed and checked by an independent qualified third party. The latest set of requirements for OSPP v4.2 can be found here: https://www.niap-ccevs.org/Profile/Info.cfm?PPID=424&id=424 If you look on page 58, you will see the following requirement: FPT_SRP_EXT.1 Software Restriction Policies FPT_SRP_EXT.1.1 administrator specified [selection: file path, file digital signature, version, hash, [assignment: other characteristics] ] This patch is to help aid in meeting this requirement. Note that this set of patches are based on Amir's fsnotify-fixes branch, which has already been posted through for review. For those interested, this branch can be found here: https://github.com/amir73il/linux/commits/fsnotify-fixes LTP tests for this feature are on my 'fanotify-exec' branch here: https://github.com/matthewbobrowski/ltp/commits/fanotify_exec. The files that contains the test cases are provided below: syscalls/fanotify03: test cases have been updated to cover FAN_OPEN_EXEC_PERM events syscalls/fanotify12: newly introduced LTP test file to cover FAN_OPEN_EXEC events The man pages updates for these newly defined event masks can be found here: https://github.com/matthewbobrowski/man-pages/commits/fanotify_exec. I would like to thank both Amir and Jan for their time and help, highly appreciated once again. --- Matthew Bobrowski (4): fanotify: return only user requested event types in event mask fanotify: introduce new event mask FAN_OPEN_EXEC fanotify: introduce new event mask FAN_OPEN_EXEC_PERM fsnotify: don't merge events FS_OPEN_PERM and FS_OPEN_EXEC_PERM fs/notify/fanotify/fanotify.c | 29 +++++++++------- fs/notify/fsnotify.c | 2 +- include/linux/fanotify.h | 5 +-- include/linux/fsnotify.h | 58 +++++++++++++++++++------------- include/linux/fsnotify_backend.h | 13 ++++--- include/uapi/linux/fanotify.h | 2 ++ 6 files changed, 66 insertions(+), 43 deletions(-)