summaryrefslogtreecommitdiffstats
path: root/security
Commit message (Collapse)AuthorAgeFilesLines
* ima: fix get_binary_runtime_size()Roberto Sassu2017-06-211-1/+1
| | | | | | | | Remove '+ 1' from 'size += strlen(entry->template_desc->name) + 1;', as the template name is sent to userspace without the '\0' character. Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: use ima_parse_buf() to parse template dataRoberto Sassu2017-06-211-31/+13
| | | | | | | | | | | | The binary_field_data structure definition has been removed from ima_restore_template_data(). The lengths and data pointers are directly stored into the template_data array of the ima_template_entry structure. For template data, both the number of fields and buffer end checks can be done, as these information are known (respectively from the template descriptor, and from the measurement header field). Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: use ima_parse_buf() to parse measurements headersRoberto Sassu2017-06-211-52/+28
| | | | | | | | | | | | | | | The binary_hdr_v1 and binary_data_v1 structures defined in ima_restore_measurement_list() have been replaced with an array of four ima_field_data structures where pcr, digest, template name and template data lengths and pointers are stored. The length of pcr and digest in the ima_field_data array and the bits in the bitmap are set before ima_parse_buf() is called. The ENFORCE_FIELDS bit is set for all entries except the last one (there is still data to parse), and ENFORCE_BUFEND is set only for the last entry. Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: introduce ima_parse_buf()Roberto Sassu2017-06-212-0/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ima_parse_buf() takes as input the buffer start and end pointers, and stores the result in a static array of ima_field_data structures, where the len field contains the length parsed from the buffer, and the data field contains the address of the buffer just after the length. Optionally, the function returns the current value of the buffer pointer and the number of array elements written. A bitmap has been added as parameter of ima_parse_buf() to handle the cases where the length is not prepended to data. Each bit corresponds to an element of the ima_field_data array. If a bit is set, the length is not parsed from the buffer, but is read from the corresponding element of the array (the length must be set before calling the function). ima_parse_buf() can perform three checks upon request by callers, depending on the enforce mask passed to it: - ENFORCE_FIELDS: matching of number of fields (length-data combination) - there must be enough data in the buffer to parse the number of fields requested (output: current value of buffer pointer) - ENFORCE_BUFEND: matching of buffer end - the ima_field_data array must be large enough to contain lengths and data pointers for the amount of data requested (output: number of fields written) - ENFORCE_FIELDS | ENFORCE_BUFEND: matching of both Use cases - measurement entry header: ENFORCE_FIELDS | ENFORCE_BUFEND - four fields must be parsed: pcr, digest, template name, template data - ENFORCE_BUFEND is enforced only for the last measurement entry - template digest (Crypto Agile): ENFORCE_BUFEND - since only the total template digest length is known, the function parses length-data combinations until the buffer end is reached - template data: ENFORCE_FIELDS | ENFORCE_BUFEND - since the number of fields and the total template data length are known, the function can perform both checks Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: Add cgroups2 to the defaults listLaura Abbott2017-06-211-0/+3
| | | | | | | | cgroups2 is beginning to show up in wider usage. Add it to the default nomeasure/noappraise list like other filesystems. Signed-off-by: Laura Abbott <labbott@redhat.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: use memdup_user_nulGeliang Tang2017-06-211-9/+4
| | | | | | | | Use memdup_user_nul() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang <geliangtang@gmail.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: fix up #endif commentsTycho Andersen2017-06-211-2/+2
| | | | | | | | While reading the code, I noticed that these #endif comments don't match how they're actually nested. This patch fixes that. Signed-off-by: Tycho Andersen <tycho@docker.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* IMA: Correct Kconfig dependencies for hash selectionBen Hutchings2017-06-211-4/+4
| | | | | | | | IMA uses the hash algorithm too early to be able to use a module. Require the selected hash algorithm to be built-in. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: define is_ima_appraise_enabled()Mimi Zohar2017-06-211-0/+10
| | | | | | | | | Only return enabled if in enforcing mode, not fix or log modes. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Changes: - Define is_ima_appraise_enabled() as a bool (Thiago Bauermann)
* ima: define Kconfig IMA_APPRAISE_BOOTPARAM optionMimi Zohar2017-06-212-0/+10
| | | | | | | Permit enabling the different "ima_appraise=" modes (eg. log, fix) from the boot command line. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* ima: define a set of appraisal rules requiring file signaturesMimi Zohar2017-06-211-1/+25
| | | | | | | | | | | | | | | | | | | The builtin "ima_appraise_tcb" policy should require file signatures for at least a few of the hooks (eg. kernel modules, firmware, and the kexec kernel image), but changing it would break the existing userspace/kernel ABI. This patch defines a new builtin policy named "secure_boot", which can be specified on the "ima_policy=" boot command line, independently or in conjunction with the "ima_appraise_tcb" policy, by specifing ima_policy="appraise_tcb | secure_boot". The new appraisal rules requiring file signatures will be added prior to the "ima_appraise_tcb" rules. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Changelog: - Reference secure boot in the new builtin policy name. (Thiago Bauermann)
* ima: extend the "ima_policy" boot command line to support multiple policiesMimi Zohar2017-06-211-5/+10
| | | | | | | Add support for providing multiple builtin policies on the "ima_policy=" boot command line. Use "|" as the delimitor separating the policy names. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
* Merge branch 'smack-for-4.13' of git://github.com/cschaufler/smack-next into ↵James Morris2017-06-214-18/+31
|\ | | | | | | next
| * Smack: Use cap_capable in privilege checkCasey Schaufler2017-06-012-9/+12
| | | | | | | | | | | | | | | | | | Use cap_capable() rather than capable() in the Smack privilege check as the former does not invoke other security module privilege check, while the later does. This becomes important when stacking. It may be a problem even with minor modules. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
| * Smack: Safer check for a socket in file_receiveCasey Schaufler2017-06-011-1/+1
| | | | | | | | | | | | | | | | The check of S_ISSOCK() in smack_file_receive() is not appropriate if the passed descriptor is a socket. Reported-by: Stephen Smalley <sds@tyco.nsa.gov> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
| * smack: use pernet operations for hook registrationFlorian Westphal2017-06-011-8/+18
| | | | | | | | | | | | | | It will allow us to remove the old netfilter hook api in the near future. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
* | apparmor: export that basic profile namespaces are supportedJohn Johansen2017-06-101-0/+7
| | | | | | | | | | | | | | Allow userspace to detect that basic profile policy namespaces are available. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: add stacked domain labels interfaceJohn Johansen2017-06-102-0/+8
| | | | | | | | | | | | Update the user interface to support the stacked change_profile transition. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: add domain label stacking info to apparmorfsJohn Johansen2017-06-103-0/+39
| | | | | | | | | | | | | | Now that the domain label transition is complete advertise it to userspace. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move change_profile mediation to using labelsJohn Johansen2017-06-101-68/+123
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move change_hat mediation to using labelsJohn Johansen2017-06-101-102/+201
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move exec domain mediation to using labelsJohn Johansen2017-06-102-259/+678
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: support v7 transition format compatible with label_parseJohn Johansen2017-06-102-7/+15
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: mediate files when they are receivedJohn Johansen2017-06-102-0/+7
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: rework file permission to cache file access in file->ctxJohn Johansen2017-06-101-6/+76
| | | | | | | | | | | | | | | | This is a temporary step, towards using the file->ctx for delegation, and also helps speed up file queries, until the permission lookup cache is introduced. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move path_link mediation to using labelsJohn Johansen2017-06-103-47/+59
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: refactor path name lookup and permission checks around labelsJohn Johansen2017-06-103-45/+85
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: update aa_audit_file() to use labelsJohn Johansen2017-06-103-9/+18
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move aa_file_perm() to use labelsJohn Johansen2017-06-103-37/+64
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: allow ptrace checks to be finer grained than just capabilityJohn Johansen2017-06-103-0/+68
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move ptrace checks to using labelsJohn Johansen2017-06-105-80/+58
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: add cross check permission helper macrosJohn Johansen2017-06-101-1/+41
| | | | | | | | | | | | | | The cross check permission helper macros will help simplify code that does cross task permission checks like ptrace. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move resource checks to using labelsJohn Johansen2017-06-103-42/+80
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move capability checks to using labelsJohn Johansen2017-06-105-29/+58
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: update query interface to support label queriesJohn Johansen2017-06-101-7/+39
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: switch getprocattr to using label_print fns()John Johansen2017-06-103-37/+27
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: switch from profiles to using labels on contextsJohn Johansen2017-06-1020-529/+686
| | | | | | | | | | | | | | | | Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: add the base fns() for domain labelsJohn Johansen2017-06-102-0/+2561
| | | | | | | | | | | | | | | | Begin moving apparmor to using broader domain labels, that will allow run time computation of domain type splitting via "stacking" of profiles into a domain label vec. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: revalidate files during execJohn Johansen2017-06-104-0/+81
| | | | | | | | | | | | | | | | | | Instead of running file revalidation lazily when read/write are called copy selinux and revalidate the file table on exec. This avoids extra mediation overhead in read/write and also prevents file handles being passed through to a grand child unchecked. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: cleanup rename XXX_file_context() to XXX_file_ctx()John Johansen2017-06-102-11/+16
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: convert aa_change_XXX bool parameters to flagsJohn Johansen2017-06-105-32/+29
| | | | | | | | | | | | | | Instead of passing multiple booleans consolidate on a single flags field. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: cleanup remove unused and not fully implemented profile renameJohn Johansen2017-06-101-37/+2
| | | | | | | | | | | | | | Remove the partially implemented code, until this can be properly implemented. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: refactor updating profiles to the newest parentJohn Johansen2017-06-101-4/+31
| | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: share profile name on replacementJohn Johansen2017-06-103-9/+72
| | | | | | | | | | | | The profile names are the same, leverage this. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: convert to profile block critical sectionsJohn Johansen2017-06-108-56/+162
| | | | | | | | | | | | | | | | | | | | There are still a few places where profile replacement fails to update and a stale profile is used for mediation. Fix this by moving to accessing the current label through a critical section that will always ensure mediation is using the current label regardless of whether the tasks cred has been updated or not. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: move bprm_committing_creds/committed_creds to lsm.cJohn Johansen2017-06-103-32/+30
| | | | | | | | | | | | | | | | There is no reason to have the small stubs that don't use domain private functions in domain.c, instead move them to lsm.c and make them static. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: fix display of ns nameJohn Johansen2017-06-101-1/+1
| | | | | | | | | | | | The ns name being displayed should go through an ns view lookup. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: fix apparmor_query dataJohn Johansen2017-06-101-2/+6
| | | | | | | | | | | | | | The data being queried isn't always the current profile and a lookup relative to the current profile should be done. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: fix policy load/remove semanticsJohn Johansen2017-06-102-15/+13
| | | | | | | | | | | | | | | | | | The namespace being passed into the replace/remove profiles fns() is not the view, but the namespace specified by the inode from the file hook (if present) or the loading tasks ns, if accessing the top level virtualized load/replace file interface. Signed-off-by: John Johansen <john.johansen@canonical.com>
* | apparmor: add namespace lookup fns()John Johansen2017-06-103-4/+73
| | | | | | | | | | | | | | | | | | | | | | Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen <john.johansen@canonical.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 19:23:54 +0000