From patchwork Mon Aug 14 15:04:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Grubb X-Patchwork-Id: 9899097 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A7E32602CA for ; Mon, 14 Aug 2017 15:04:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9614328484 for ; Mon, 14 Aug 2017 15:04:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 88BB428543; Mon, 14 Aug 2017 15:04:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2B1F228484 for ; Mon, 14 Aug 2017 15:04:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752661AbdHNPEO (ORCPT ); Mon, 14 Aug 2017 11:04:14 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49990 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752246AbdHNPEN (ORCPT ); Mon, 14 Aug 2017 11:04:13 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 5BDB91293 for ; Mon, 14 Aug 2017 15:04:13 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 5BDB91293 Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=sgrubb@redhat.com Received: from x2.localnet (ovpn-120-119.rdu2.redhat.com [10.10.120.119]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 15DAC721CE; Mon, 14 Aug 2017 15:04:11 +0000 (UTC) From: Steve Grubb To: fsdevel , eparis@redhat.com, Linux Audit Subject: [PATCH 1/1] Fanotify: Introduce a permissive mode Date: Mon, 14 Aug 2017 11:04:10 -0400 Message-ID: <3663877.NZSPRKlUQW@x2> Organization: Red Hat MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Mon, 14 Aug 2017 15:04:13 +0000 (UTC) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hello, The fanotify interface can be used as an access control subsystem. If for some reason the policy is bad, there is potentially no good way to recover the system. This patch introduces a new command line variable, fanotify_enforce, to allow overriding the access decision from user space. The initialization status is recorded as an audit event so that there is a record of being in permissive mode for the security officer. Signed-off-by: sgrubb --- Documentation/admin-guide/kernel-parameters.txt | 7 +++++ fs/notify/fanotify/fanotify.c | 42 +++++++++++++++++++++++-- include/uapi/linux/audit.h | 1 + 3 files changed, 47 insertions(+), 3 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 7737ab5..84c0e78 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1141,6 +1141,13 @@ Format: ,,, See also Documentation/fault-injection/. + fanotify_enforce=[FANOTIFY] Enable or disable enforcement of policy + decisions at boot time. + Format: { "0" | "1" } + 0 -- disable enforcement. + 1 -- enable enforcement. + Default value is 1 (enforcing). + floppy= [HW] See Documentation/blockdev/floppy.txt. diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c index 2fa99ae..cab5c2b 100644 --- a/fs/notify/fanotify/fanotify.c +++ b/fs/notify/fanotify/fanotify.c @@ -9,9 +9,43 @@ #include #include #include +#include #include "fanotify.h" + +#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS +/* + * This variable determines if the decisions made by user space listener + * will be enforced or overridden for system recovery + */ +static unsigned int enforcing_mode = 1; + + +/* Record status of the fanotify sunsystem */ +static int __init fanotify_init(void) +{ + audit_log(NULL, GFP_KERNEL, AUDIT_FANOTIFY_STATUS, + "state=initialized fanotify_enforce=%u res=1", + enforcing_mode); + return 0; +} +late_initcall(fanotify_init); + +static int __init set_fanotify_enforce(char *str) +{ + long val; + + if (kstrtol(str, 0, &val) == 0) { + enforcing_mode = !!val; + pr_info("fanotify initialized with fanotify_enforce=%u\n", + enforcing_mode); + } + return 1; +} +__setup("fanotify_enforce=", set_fanotify_enforce); +#endif + static bool should_merge(struct fsnotify_event *old_fsn, struct fsnotify_event *new_fsn) { @@ -88,9 +122,12 @@ static int fanotify_get_response(struct fsnotify_group *group, } event->response = 0; - pr_debug("%s: group=%p event=%p about to return ret=%d\n", __func__, - group, event, ret); - + pr_debug("%s: group=%p event=%p about to return ret=%d enforce=%u\n", + __func__, group, event, ret, enforcing_mode); + + if (unlikely(!enforcing_mode)) + ret = 0; + return ret; } #endif diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 0714a66..9560627 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -112,6 +112,7 @@ #define AUDIT_FEATURE_CHANGE 1328 /* audit log listing feature changes */ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ +#define AUDIT_FANOTIFY_STATUS 1331 /* Fanotify enforcing status */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */