From patchwork Tue May 5 15:31:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= X-Patchwork-Id: 11529503 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EED3881 for ; Tue, 5 May 2020 15:41:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DFB7E206FA for ; Tue, 5 May 2020 15:41:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730440AbgEEPlr (ORCPT ); Tue, 5 May 2020 11:41:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34392 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729398AbgEEPlq (ORCPT ); Tue, 5 May 2020 11:41:46 -0400 X-Greylist: delayed 559 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Tue, 05 May 2020 08:41:46 PDT Received: from smtp-bc0d.mail.infomaniak.ch (smtp-bc0d.mail.infomaniak.ch [IPv6:2001:1600:3:17::bc0d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66F7AC061A0F for ; Tue, 5 May 2020 08:41:46 -0700 (PDT) Received: from smtp-2-0000.mail.infomaniak.ch (unknown [10.5.36.107]) by smtp-2-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 49GkHQ3pJnzlhWgZ; Tue, 5 May 2020 17:32:18 +0200 (CEST) Received: from localhost (unknown [94.23.54.103]) by smtp-2-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 49GkHP3cXJzlq4Rd; Tue, 5 May 2020 17:32:17 +0200 (CEST) From: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= To: linux-kernel@vger.kernel.org Cc: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Aleksa Sarai , Alexei Starovoitov , Al Viro , Andy Lutomirski , Christian Heimes , Daniel Borkmann , Deven Bowers , Eric Chiang , Florian Weimer , James Morris , Jan Kara , Jann Horn , Jonathan Corbet , Kees Cook , Lakshmi Ramasubramanian , Matthew Garrett , Matthew Wilcox , Michael Kerrisk , =?utf-8?q?Micka=C3=ABl_Sala=C3=BC?= =?utf-8?q?n?= , Mimi Zohar , =?utf-8?q?Philippe_Tr=C3=A9buchet?= , Scott Shell , Sean Christopherson , Shuah Khan , Steve Dower , Steve Grubb , Thibaut Sautereau , Vincent Strubel , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: [PATCH v5 0/6] Add support for O_MAYEXEC Date: Tue, 5 May 2020 17:31:50 +0200 Message-Id: <20200505153156.925111-1-mic@digikod.net> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 X-Antivirus: Dr.Web (R) for Unix mail servers drweb plugin ver.6.0.2.8 X-Antivirus-Code: 0x100000 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Hi, This fifth patch series add new kernel configurations (OMAYEXEC_STATIC, OMAYEXEC_ENFORCE_MOUNT, and OMAYEXEC_ENFORCE_FILE) to enable to configure the security policy at kernel build time. As requested by Mimi Zohar, I completed the series with one of her patches for IMA. The goal of this patch series is to enable to control script execution with interpreters help. A new O_MAYEXEC flag, usable through openat2(2), is added to enable userspace script interpreter to delegate to the kernel (and thus the system security policy) the permission to interpret/execute scripts or other files containing what can be seen as commands. A simple system-wide security policy can be enforced by the system administrator through a sysctl configuration consistent with the mount points or the file access rights. The documentation patch explains the prerequisites. Furthermore, the security policy can also be delegated to an LSM, either a MAC system or an integrity system. For instance, the new kernel MAY_OPENEXEC flag closes a major IMA measurement/appraisal interpreter integrity gap by bringing the ability to check the use of scripts [1]. Other uses are expected, such as for openat2(2) [2], SGX integration [3], bpffs [4] or IPE [5]. Userspace needs to adapt to take advantage of this new feature. For example, the PEP 578 [6] (Runtime Audit Hooks) enables Python 3.8 to be extended with policy enforcement points related to code interpretation, which can be used to align with the PowerShell audit features. Additional Python security improvements (e.g. a limited interpreter withou -c, stdin piping of code) are on their way. The initial idea come from CLIP OS 4 and the original implementation has been used for more than 12 years: https://github.com/clipos-archive/clipos4_doc An introduction to O_MAYEXEC was given at the Linux Security Summit Europe 2018 - Linux Kernel Security Contributions by ANSSI: https://www.youtube.com/watch?v=chNjCRtPKQY&t=17m15s The "write xor execute" principle was explained at Kernel Recipes 2018 - CLIP OS: a defense-in-depth OS: https://www.youtube.com/watch?v=PjRE0uBtkHU&t=11m14s This patch series can be applied on top of v5.7-rc4. This can be tested with CONFIG_SYSCTL. I would really appreciate constructive comments on this patch series. Previous version: https://lore.kernel.org/lkml/20200428175129.634352-1-mic@digikod.net/ [1] https://lore.kernel.org/lkml/1544647356.4028.105.camel@linux.ibm.com/ [2] https://lore.kernel.org/lkml/20190904201933.10736-6-cyphar@cyphar.com/ [3] https://lore.kernel.org/lkml/CALCETrVovr8XNZSroey7pHF46O=kj_c5D9K8h=z2T_cNrpvMig@mail.gmail.com/ [4] https://lore.kernel.org/lkml/CALCETrVeZ0eufFXwfhtaG_j+AdvbzEWE0M3wjXMWVEO7pj+xkw@mail.gmail.com/ [5] https://lore.kernel.org/lkml/20200406221439.1469862-12-deven.desai@linux.microsoft.com/ [6] https://www.python.org/dev/peps/pep-0578/ Regards, Mickaël Salaün (5): fs: Add support for an O_MAYEXEC flag on openat2(2) fs: Add a MAY_EXECMOUNT flag to infer the noexec mount property fs: Enable to enforce noexec mounts or file exec through O_MAYEXEC selftest/openat2: Add tests for O_MAYEXEC enforcing doc: Add documentation for the fs.open_mayexec_enforce sysctl Mimi Zohar (1): ima: add policy support for the new file open MAY_OPENEXEC flag Documentation/ABI/testing/ima_policy | 2 +- Documentation/admin-guide/sysctl/fs.rst | 44 +++ fs/fcntl.c | 2 +- fs/namei.c | 89 ++++- fs/open.c | 8 + include/linux/fcntl.h | 2 +- include/linux/fs.h | 9 + include/uapi/asm-generic/fcntl.h | 7 + kernel/sysctl.c | 9 + security/Kconfig | 26 ++ security/integrity/ima/ima_main.c | 3 +- security/integrity/ima/ima_policy.c | 15 +- tools/testing/selftests/kselftest_harness.h | 3 + tools/testing/selftests/openat2/Makefile | 3 +- tools/testing/selftests/openat2/config | 1 + tools/testing/selftests/openat2/helpers.h | 1 + .../testing/selftests/openat2/omayexec_test.c | 330 ++++++++++++++++++ 17 files changed, 544 insertions(+), 10 deletions(-) create mode 100644 tools/testing/selftests/openat2/config create mode 100644 tools/testing/selftests/openat2/omayexec_test.c