Introduce a new hook called DIGEST_LIST_CHECK to measure and appraise files read by the kernel with type READING_DIGEST_LIST. Files with this type are: - digest lists directly read by the kernel - executables of digest list parsers - files read by the parsers (including digest lists)

Typical rules with the new hook are: - measure func=DIGEST_LIST_CHECK pcr=11 - appraise func=DIGEST_LIST_CHECK appraise_type=imasig|modsig

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_main.c | 3 ++- security/integrity/ima/ima_policy.c | 3 +++ 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index be965a8715e4..d01ca3566aec 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -202,6 +202,7 @@ static inline unsigned int ima_hash_key(u8 *digest) hook(KEY_CHECK, key) \ hook(CRITICAL_DATA, critical_data) \ hook(SETXATTR_CHECK, setxattr_check) \ + hook(DIGEST_LIST_CHECK, digest_list) \ hook(MAX_CHECK, none)

#define __ima_hook_enumify(ENUM, str) ENUM, diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 26a709207ca3..d33765c7aaa7 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -723,7 +723,8 @@ const int read_idmap[READING_MAX_ID] = { [READING_MODULE] = MODULE_CHECK, [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK, [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK, - [READING_POLICY] = POLICY_CHECK + [READING_POLICY] = POLICY_CHECK, + [READING_DIGEST_LIST] = DIGEST_LIST_CHECK };

/** diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 761ae5b63735..8d6f5d85dfa4 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -1222,6 +1222,7 @@ static bool ima_validate_rule(struct ima_rule_entry *entry) case MODULE_CHECK: case KEXEC_KERNEL_CHECK: case KEXEC_INITRAMFS_CHECK: + case DIGEST_LIST_CHECK: if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC | IMA_UID | IMA_FOWNER | IMA_FSUUID | IMA_INMASK | IMA_EUID | IMA_PCR | @@ -1446,6 +1447,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) entry->func = CRITICAL_DATA; else if (strcmp(args[0].from, "SETXATTR_CHECK") == 0) entry->func = SETXATTR_CHECK; + else if (strcmp(args[0].from, "DIGEST_LIST_CHECK") == 0) + entry->func = DIGEST_LIST_CHECK; else result = -EINVAL; if (!result)

Introduce a new LSM to keep track of the operations performed by digest list parsers to convert the digest lists and upload them to the kernel.

The motivation and its behavior is described more in detail in Documentation/security/diglim/lsm.rst.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- Documentation/security/diglim/index.rst | 1 + Documentation/security/diglim/lsm.rst | 65 ++++ MAINTAINERS | 1 + security/integrity/diglim/Makefile | 2 +- security/integrity/diglim/diglim.h | 27 ++ security/integrity/diglim/fs.c | 3 + security/integrity/diglim/hooks.c | 436 ++++++++++++++++++++++++ 7 files changed, 534 insertions(+), 1 deletion(-) create mode 100644 Documentation/security/diglim/lsm.rst create mode 100644 security/integrity/diglim/hooks.c

diff --git a/Documentation/security/diglim/index.rst b/Documentation/security/diglim/index.rst index d4ba4ce50a59..bf3cc4a9a91d 100644 --- a/Documentation/security/diglim/index.rst +++ b/Documentation/security/diglim/index.rst @@ -12,3 +12,4 @@ Digest Lists Integrity Module (DIGLIM) implementation remote_attestation tests + lsm diff --git a/Documentation/security/diglim/lsm.rst b/Documentation/security/diglim/lsm.rst new file mode 100644 index 000000000000..ce979e6c6dfd --- /dev/null +++ b/Documentation/security/diglim/lsm.rst @@ -0,0 +1,65 @@ +.. SPDX-License-Identifier: GPL-2.0 + +LSM +=== + +When digest lists (in compact format) are directly uploaded by the kernel, +determining their integrity is straightforward, as a file open is the only +operation performed. + +However, if digest lists are first processed by a user space parser, many +operations occur before the converted digest list is uploaded to the +kernel, and any of them may affect the result of the conversion. In this +case, the integrity of all files involved must be evaluated to ensure that +the output is the expected one. + +The new DIGLIM LSM has been introduced with two goals: the first is to +identify user space parsers as soon as they are loaded, in order to monitor +the operations they perform; the second is to avoid interference from other +processes, which are assumed as untrusted. + +Regarding the first goal, user space parsers are identified by calculating +the digest of their executable and searching it in the DIGLIM hash table. +An executable is successfully recognized as a digest list parser if its +digest is found and the associated type is COMPACT_PARSER. Once a parser +has been identified, DIGLIM LSM monitors the integrity of opened files. In +addition, it also denies access to ld.so.cache, to avoid an unknown +measurement or appraisal failure, and to files without content measurable +by IMA (e.g. character devices). + +The integrity status of the parser, a set of flags representing the +operations performed by IMA, is kept in the credentials of the process +identified as parser. Initially, the flags are set from the operations done +on the executable and they are AND-ed with the flags retrieved at each file +open (which themselves are set from the operations done by IMA on that +file). This ensures that even if one file was not processed, this is +reflected in the global integrity status of the parser. Given that the AND +operation prevents the cleared flag to be set again, the only way to upload +a converted digest list with that flag is to restart the parser. + +The flags still set in the process credentials at the time the parser +uploads the converted digest lists are then copied to the converted lists +themselves, so that they can be retrieved by DIGLIM users during a digest +query and evaluated (the query result might be discarded). This mechanism +is reliable against LSM misconfiguration: if for any reason DIGLIM LSM is +turned off, no flags will be set in the converted digest list. + +Regarding the second goal, avoiding interference from other user space +processes is necessary if they are assumed to be untrusted. This threat +model applies if the system is supposed to enforce a mandatory policy where +only files shipped by software vendors are allowed to be accessed. The +mandatory policy could be also defined by system administrators (they could +decide the set of approved software vendors). + +To avoid interference to the user space parsers from other processes, the +following countermeasures are implemented. First, files accessed by user +space parsers are exclusively write-locked until the parsers finish to use +them. A failure when write-locking a file (if the file was already opened +for writing by another process) will result in the file access to be denied +to the parser. Second, ptraces on the parsers are also denied as they might +influence their execution. + +Other than these two limitations (not being able to access files +write-locked by the parsers and to ptrace the parsers), processes which are +not identified as parsers are not subject to the policy enforcement by +DIGLIM LSM. diff --git a/MAINTAINERS b/MAINTAINERS index 0ffceb271803..94220e40b7e2 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5511,6 +5511,7 @@ F: Documentation/security/diglim/architecture.rst F: Documentation/security/diglim/implementation.rst F: Documentation/security/diglim/index.rst F: Documentation/security/diglim/introduction.rst +F: Documentation/security/diglim/lsm.rst F: Documentation/security/diglim/remote_attestation.rst F: Documentation/security/diglim/tests.rst F: include/linux/diglim.h diff --git a/security/integrity/diglim/Makefile b/security/integrity/diglim/Makefile index ae79a3317ec8..37fa6ef2a73c 100644 --- a/security/integrity/diglim/Makefile +++ b/security/integrity/diglim/Makefile @@ -5,4 +5,4 @@

obj-$(CONFIG_DIGLIM) += diglim.o

-diglim-y := methods.o parser.o ima.o fs.o loader.o +diglim-y := methods.o parser.o ima.o fs.o loader.o hooks.o diff --git a/security/integrity/diglim/diglim.h b/security/integrity/diglim/diglim.h index c597c2e7a52a..b53de803a63c 100644 --- a/security/integrity/diglim/diglim.h +++ b/security/integrity/diglim/diglim.h @@ -21,6 +21,7 @@ #include <crypto/hash_info.h> #include <linux/hash_info.h> #include <linux/diglim.h> +#include <linux/lsm_hooks.h>

#include "../integrity.h"

@@ -28,6 +29,13 @@ #define HASH_BITS 10 #define DIGLIM_HTABLE_SIZE (1 << HASH_BITS)

+#define FLAG_PARSER_EXEC 0x01 +#define FLAG_PARSER_FILE_ACCESS 0x02 +#define FLAG_PARSER_FILE_ACCESS_DENY 0x04 + +extern struct lsm_blob_sizes diglim_lsm_blob_sizes; +extern int diglim_lsm_enabled; + /** * struct digest_list_item - a digest list loaded into the kernel * @@ -229,4 +237,23 @@ int diglim_ima_get_info(struct file *file, u8 *buffer, size_t buffer_len, enum hash_algo *algo, u8 *actions);

ssize_t digest_list_read(struct path *root, char *path, enum ops op); +static inline u8 *diglim_cred_actions(const struct cred *cred) +{ + return cred->security + diglim_lsm_blob_sizes.lbs_cred; +} + +static inline u8 *diglim_cred_flags(const struct cred *cred) +{ + return diglim_cred_actions(cred) + 1; +} + +static inline u8 *diglim_inode(const struct inode *inode) +{ + return inode->i_security + diglim_lsm_blob_sizes.lbs_inode; +} + +static inline u8 *diglim_file(const struct file *file) +{ + return file->f_security + diglim_lsm_blob_sizes.lbs_file; +} #endif /*__DIGLIM_INTERNAL_H*/ diff --git a/security/integrity/diglim/fs.c b/security/integrity/diglim/fs.c index 467ff4f7c0ce..56c6f7ff2b3c 100644 --- a/security/integrity/diglim/fs.c +++ b/security/integrity/diglim/fs.c @@ -577,6 +577,9 @@ static ssize_t digest_list_write(struct file *file, const char __user *buf, enum hash_algo algo; u8 actions = 0;

+ if (diglim_lsm_enabled) + actions = *diglim_cred_actions(current_cred()); + /* No partial writes. */ result = -EINVAL; if (*ppos != 0) diff --git a/security/integrity/diglim/hooks.c b/security/integrity/diglim/hooks.c new file mode 100644 index 000000000000..f186ffbac628 --- /dev/null +++ b/security/integrity/diglim/hooks.c @@ -0,0 +1,436 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2021 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Functions to evaluate the integrity of converted digest lists. + */ + +#include <linux/vmalloc.h> +#include <linux/module.h> +#include <linux/cred.h> +#include <linux/lsm_hooks.h> +#include <linux/binfmts.h> +#include <linux/xattr.h> +#include <linux/file.h> +#include <linux/fdtable.h> +#include <linux/sched/mm.h> +#include <linux/ima.h> +#include <uapi/linux/magic.h> + +#include "diglim.h" + +int diglim_lsm_enabled; + +/** + * diglim_file_read_with_ima - read the file with IMA + * @file: file descriptor of the file being accessed + * + * This function opens the file again so that it can pass the file descriptor to + * IMA for reading the file. It also marks the inode so that diglim_file_open() + * recognizes that the open was made by DIGLIM LSM and does not process it. + * + * NOTE: the second open might be not necessary, depending on the IMA policy; + * however, since the second open is always performed with type + * READING_DIGEST_LIST, it can be easily monitored by IMA with a rule with + * func=DIGEST_LIST_CHECK + * + * Return: 0 on success, a negative value on error + */ +static int diglim_file_read_with_ima(struct file *file) +{ + struct inode *inode = file_inode(file); + u8 *inode_flags = diglim_inode(inode); + void *datap = NULL; + struct file *f; + int ret, flags; + + /* Taken from ima_crypto.c. */ + flags = file->f_flags & ~(O_WRONLY | O_APPEND | O_TRUNC | O_CREAT | + O_NOCTTY | O_EXCL); + flags |= O_RDONLY; + + /* Signal to diglim_file_open() to not evaluate the second open. */ + *inode_flags |= FLAG_PARSER_FILE_ACCESS; + /* Open an additional file descriptor to use with ima_read_file(). */ + f = dentry_open(&file->f_path, flags, file->f_cred); + *inode_flags &= ~FLAG_PARSER_FILE_ACCESS; + if (IS_ERR(f)) + return PTR_ERR(f); + + /* + * Pass the file descriptor to IMA with file type READING_DIGEST_LIST, + * so that this operation can be more easily identified with an IMA rule + * with func=DIGEST_LIST_CHECK. + */ + ret = kernel_read_file(f, 0, &datap, INT_MAX, NULL, + READING_DIGEST_LIST); + if (ret >= 0) + vfree(datap); + + fput(f); + return ret; +} + +/** + * diglim_identify_parser - identify a digest list parser from the executable + * @cred: credentials of the child process + * @file: file descriptor of the child process executable + * + * This function first identifies a digest list parser from the executable, by + * searching the executable digest in the DIGLIM hash table. A parser is + * successfully identified if the digest is found in the hash table and if the + * type of the found digest is COMPACT_PARSER. + * + * If a parser has been successfully identified, this function also sets the + * actions performed by IMA on the executable in the process credentials. These + * initial actions will be AND-ed with the actions performed by IMA on each + * regular file opened by the parser. A missing action for a file will cause + * the corresponding action in the process credentials to be irreversibly + * cleared. + * + * Updating the actions in the process credentials in this way makes it clear + * whether or not the parser is suitable for use for a particular integrity goal + * (measurement or appraisal). If an action is set, it means that the executable + * and the process inputs have been evaluated for a particular goal, and from + * this it can be inferred that the output of the process is also correct. + * + * Return: 0 if a digest list parser has been successfully identified, a + * negative value otherwise + */ +static int diglim_identify_parser(const struct cred *cred, struct file *file) +{ + struct integrity_iint_cache *iint; + struct inode *inode = file_inode(file); + u8 *parser_actions = diglim_cred_actions(cred); + u8 digest[IMA_MAX_DIGEST_SIZE]; + enum hash_algo algo = HASH_ALGO__LAST; + u16 modifiers = 0; + u8 digest_list_actions = 0, file_actions = 0; + int ret = -ENOENT; + + /* Read the file with IMA. */ + ret = diglim_file_read_with_ima(file); + if (ret < 0) + return ret; + + iint = integrity_iint_find(inode); + if (!iint) + return ret; + + /* + * Since executables are write-protected, information obtained from IMA + * (digest and actions performed on the executable) are safe to use + * without the risk of races with writers. + */ + mutex_lock(&iint->mutex); + if (!(iint->flags & IMA_COLLECTED)) { + mutex_unlock(&iint->mutex); + goto out; + } + + /* Query the executable digest to determine if it is a parser. */ + ret = diglim_digest_get_info(iint->ima_hash->digest, + iint->ima_hash->algo, COMPACT_PARSER, + &modifiers, &digest_list_actions); + + mutex_unlock(&iint->mutex); + + if (ret < 0) + goto out; + + /* Obtain the flags from IMA operations on the executable. */ + ret = diglim_ima_get_info(file, NULL, 0, NULL, digest, sizeof(digest), + &algo, &file_actions); + if (!ret) + *parser_actions |= file_actions; + + pr_debug("%s: task: %d(%s), parser initial actions: %d\n", __func__, + current->pid, current->comm, *parser_actions); +out: + return ret; +} + +/** + * diglim_bprm_committing_creds - implement the bprm_committing_creds hook + * @bprm: linux_binprm structure of the file being executed + * + * This function implements the bprm_committing_creds hook, to identify a digest + * list parser from the digest of the executable. After a successful + * identification, the FLAG_PARSER_EXEC flag is set in the process credentials, + * so that the diglim_file_open() hook below knows that it should enforce the + * parser policy. + */ +static void diglim_bprm_committing_creds(struct linux_binprm *bprm) +{ + u8 *parser_flags = diglim_cred_flags(bprm->cred); + int ret; + + /* + * Try to identify the parsers if the parent directory is named diglim. + */ + if (strcmp(file_dentry(bprm->file)->d_parent->d_name.name, "diglim")) + return; + + ret = diglim_identify_parser(bprm->cred, bprm->file); + if (ret < 0) + return; + + *parser_flags |= FLAG_PARSER_EXEC; +} + +/** + * diglim_file_open_check - check file access and if IMA eval is required + * @file: file descriptor of the file being accessed + * + * This function checks a file access and determines whether or not it is safe + * for the parser to access the file. Access (read) is considered safe if the + * file is in a trusted filesystem (procfs, securityfs), does not have content + * to be read or it has content that can be measured/appraised by IMA, and there + * are no concurrent writes. + * + * NOTE: access to ld.so.cache, although it can be allowed, is instead denied to + * avoid an unknown measurement in the measurement list or appraisal + * failure. + * + * This function also determines whether an IMA evaluation is required. + * + * The following table summarizes the policy enforced on the parsers. + * + * Not parser parser + * +-----------+--------------+-----------------------+-----------------------+ + * | operation | file type | | | + * +-----------+--------------+ | | + * | | ld.so.cache | allow | allow | + * | | reg | allow [1] | allow | + * | write | dir/link | allow | allow | + * | | procfs/secfs | allow | allow | + * | | char/block/ | allow | allow | + * | | socket/fifo | | | + * +-----------+--------------+-----------------------+-----------------------+ + * | | ld.so.cache | allow | deny | + * | | reg | allow | allow [2] + IMA eval | + * | read | dir/link | allow | allow | + * | | procfs/secfs | allow | allow | + * | | char/block/ | allow | deny | + * | | socket/fifo | | | + * +-----------+--------------+-----------------------+-----------------------+ + * + * [1]: if not write-locked by the parser + * [2]: if there are no concurrent writes + * + * Return: 0 if access is allowed but IMA eval is not required, -EPERM if access + * is denied and 1 if access is allowed and IMA eval is required. + */ +static int diglim_file_open_check(struct file *file) +{ + struct inode *inode = file_inode(file); + + /* Skip non-read operations. */ + if (!(file->f_mode & FMODE_READ)) + return 0; + + /* Deny access to ld.so.cache. */ + if (!strcmp(file_dentry(file)->d_name.name, "ld.so.cache")) + return -EPERM; + + /* Deny access to files that can have content but cannot be measured. */ + if (!S_ISREG(inode->i_mode) && !S_ISLNK(inode->i_mode) && + !S_ISDIR(inode->i_mode)) + return -EPERM; + + /* Allow access to dirs and symlinks. */ + if (!S_ISREG(inode->i_mode)) + return 0; + + /* Allow access to files in procfs and securityfs. */ + if (inode->i_sb->s_magic == PROC_SUPER_MAGIC || + inode->i_sb->s_magic == SECURITYFS_MAGIC) + return 0; + + return 1; +} + +/** + * diglim_file_lock - write-lock the file before retrieving IMA actions + * @file: file descriptor of the file being locked + * + * This function write-locks the file being accessed in order to safely retrieve + * IMA actions and ensure that there are no concurrent writes, which would cause + * the retrieved actions to be outdated. + * + * Since IMA eventually resets the actions only when the file is closed, getting + * the exclusive write-lock ensures that the actions are up to date (for the + * exclusive write-lock to succeed there must be no pending writes, which means + * that IMA already updated the actions in ima_check_last_writer()). + * + * Return: 0 on success, -ETXTBSY if the file cannot be write-locked + */ +static int diglim_file_lock(struct file *file) +{ + u8 *file_flags = diglim_file(file); + int ret; + + /* Write-lock the file until the parser finishes to use it. */ + ret = deny_write_access(file); + if (ret < 0) + return ret; + + /* Grab a reference to the inode to avoid free before unlocking it. */ + igrab(file_inode(file)); + + /* Record deny_write_access() call in the file descriptor. */ + *file_flags |= FLAG_PARSER_FILE_ACCESS_DENY; + return 0; +} + +/** + * diglim_file_unlock - unlock the file locked by DIGLIM LSM + * @file: file descriptor of the file being unlocked + * + * This function first checks if the file was locked by DIGLIM LSM, and if yes, + * unlocks it. + */ +static void diglim_file_unlock(struct file *file) +{ + u8 *file_flags; + + file_flags = diglim_file(file); + + /* File not write-locked by DIGLIM LSM. */ + if (!(*file_flags & FLAG_PARSER_FILE_ACCESS_DENY)) + return; + + /* Release write-lock. */ + allow_write_access(file); + + /* Clear flag. */ + *file_flags &= ~FLAG_PARSER_FILE_ACCESS_DENY; + + /* Release reference taken in diglim_file_lock(). */ + iput(file_inode(file)); +} + +/** + * diglim_file_open - check file access and update process actions + * @file: file descriptor of the file being accessed + * + * This function checks the file being accessed by the parser and does an AND + * of the actions in the parser process credentials with the actions done by IMA + * on that file. + * + * The actions in the parser process credentials will be then copied to the + * converted digest lists uploaded by the parser. + * + * Return: 0 if access is allowed, a negative value if access is denied + */ +static int diglim_file_open(struct file *file) +{ + u8 file_actions = 0; + u8 *parser_flags = diglim_cred_flags(current_cred()); + u8 *parser_actions = diglim_cred_actions(current_cred()); + u8 initial_parser_actions = *parser_actions; + struct inode *inode = file_inode(file); + u8 *inode_flags = diglim_inode(inode); + int ret; + + /* Skip processes that are not the parser. */ + if (!(*parser_flags & FLAG_PARSER_EXEC)) + return 0; + + /* Skip calls due to dentry_open() in diglim_file_read_with_ima(). */ + if (*inode_flags & FLAG_PARSER_FILE_ACCESS) + return 0; + + /* Check file access. */ + ret = diglim_file_open_check(file); + if (ret <= 0) + return ret; + + /* Try to write-lock the file. */ + ret = diglim_file_lock(file); + if (ret < 0) + return ret; + + /* Read the file with IMA. */ + ret = diglim_file_read_with_ima(file); + if (ret < 0) { + diglim_file_unlock(file); + return ret; + } + + /* Retrieve the actions performed by IMA on the file. */ + diglim_ima_get_info(file, NULL, 0, NULL, NULL, 0, NULL, &file_actions); + + /* Do an AND of the parser process actions with the file actions. */ + *parser_actions &= file_actions; + + if (*parser_actions != initial_parser_actions) + pr_err("%s: task: %d(%s), cleared parser actions, file: %s, old flags: %d, new flags: %d\n", + __func__, current->pid, current->comm, + file_dentry(file)->d_name.name, initial_parser_actions, + *parser_actions); + + return 0; +} + +/** + * diglim_file_free - unlock files accessed by the parser + * @file: file descriptor of the file being monitored + * + * This function unlocks files accessed by the parser. + */ +void diglim_file_free(struct file *file) +{ + diglim_file_unlock(file); +} + +/** + * diglim_ptrace_access_check - deny ptraces on the parser process + * @child: task being ptraced + * @mode: ptrace mode + * + * This function denies ptraces on the parser process. + * + * Return: 0 if the ptrace is not done on the parser process, -EACCES otherwise + */ +static int diglim_ptrace_access_check(struct task_struct *child, + unsigned int mode) +{ + const struct cred *cred = get_task_cred(child); + u8 *flags = diglim_cred_flags(cred); + + /* Deny ptraces to the parser. */ + if (*flags & FLAG_PARSER_EXEC) + return -EACCES; + + return 0; +} + +static struct security_hook_list diglim_lsm_hooks[] __lsm_ro_after_init = { + LSM_HOOK_INIT(bprm_committing_creds, diglim_bprm_committing_creds), + LSM_HOOK_INIT(file_open, diglim_file_open), + LSM_HOOK_INIT(file_free_security, diglim_file_free), + LSM_HOOK_INIT(ptrace_access_check, diglim_ptrace_access_check), +}; + +static int __init diglim_lsm_init(void) +{ + diglim_lsm_enabled = 1; + security_add_hooks(diglim_lsm_hooks, ARRAY_SIZE(diglim_lsm_hooks), + "diglim"); + return 0; +} + +struct lsm_blob_sizes diglim_lsm_blob_sizes __lsm_ro_after_init = { + .lbs_cred = 2 * sizeof(u8), + .lbs_inode = sizeof(u8), + .lbs_file = sizeof(u8), +}; + +DEFINE_LSM(diglim) = { + .name = "diglim", + .init = diglim_lsm_init, + .blobs = &diglim_lsm_blob_sizes, +};

Introduce a generator for the compact digest lists, which can be directly uploaded to the kernel.

This tool can be used to generate a digest list from a file or the files in the specified directory.

Files with execute permissions, without write permissions, those in /lib/modules (not files starting with modules.) and in /lib/firmware are marked as immutable (IMA with appraisal in enforcing mode will deny writes).

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- MAINTAINERS | 4 + tools/diglim/Makefile | 18 ++ tools/diglim/common.c | 79 +++++++++ tools/diglim/common.h | 59 +++++++ tools/diglim/compact_gen.c | 349 +++++++++++++++++++++++++++++++++++++ 5 files changed, 509 insertions(+) create mode 100644 tools/diglim/Makefile create mode 100644 tools/diglim/common.c create mode 100644 tools/diglim/common.h create mode 100644 tools/diglim/compact_gen.c

diff --git a/MAINTAINERS b/MAINTAINERS index 94220e40b7e2..b752790c06ea 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5522,6 +5522,10 @@ F: security/integrity/diglim/ima.c F: security/integrity/diglim/loader.c F: security/integrity/diglim/methods.c F: security/integrity/diglim/parser.c +F: tools/diglim/Makefile +F: tools/diglim/common.c +F: tools/diglim/common.h +F: tools/diglim/compact_gen.c F: tools/testing/selftests/diglim/

DIOLAN U2C-12 I2C DRIVER diff --git a/tools/diglim/Makefile b/tools/diglim/Makefile new file mode 100644 index 000000000000..45efa554449d --- /dev/null +++ b/tools/diglim/Makefile @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: GPL-2.0 + +CC := $(CROSS_COMPILE)gcc +CFLAGS += -O2 -Wall -g -I./ -I../../usr/include/ -ggdb + +PROGS := compact_gen +PROGS_EXTENDED := common.o + +all: $(PROGS) + +clean: + rm -fr $(PROGS) $(PROGS_EXTENDED) + +common.o: common.c + $(CC) -c $(CFLAGS) $< -o $@ + +compact_gen: compact_gen.c $(PROGS_EXTENDED) + $(CC) $(CFLAGS) $< $(PROGS_EXTENDED) -o $@ $(LDFLAGS) -lcrypto diff --git a/tools/diglim/common.c b/tools/diglim/common.c new file mode 100644 index 000000000000..dd5ff4b186b3 --- /dev/null +++ b/tools/diglim/common.c @@ -0,0 +1,79 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2005,2006,2007,2008 IBM Corporation + * Copyright (C) 2017-2021 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Common functions and data. + */ + +#include <sys/random.h> +#include <errno.h> +#include <stdint.h> +#include <stdlib.h> +#include <fcntl.h> +#include <ctype.h> +#include <malloc.h> +#include <unistd.h> +#include <string.h> +#include <limits.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <linux/types.h> +#include <linux/hash_info.h> + +#include "common.h" + +char *compact_types_str[COMPACT__LAST] = { + [COMPACT_PARSER] = "parser", + [COMPACT_FILE] = "file", + [COMPACT_METADATA] = "metadata", + [COMPACT_DIGEST_LIST] = "digest_list", +}; + +const char *const hash_algo_name[HASH_ALGO__LAST] = { + [HASH_ALGO_MD4] = "md4", + [HASH_ALGO_MD5] = "md5", + [HASH_ALGO_SHA1] = "sha1", + [HASH_ALGO_RIPE_MD_160] = "rmd160", + [HASH_ALGO_SHA256] = "sha256", + [HASH_ALGO_SHA384] = "sha384", + [HASH_ALGO_SHA512] = "sha512", + [HASH_ALGO_SHA224] = "sha224", + [HASH_ALGO_RIPE_MD_128] = "rmd128", + [HASH_ALGO_RIPE_MD_256] = "rmd256", + [HASH_ALGO_RIPE_MD_320] = "rmd320", + [HASH_ALGO_WP_256] = "wp256", + [HASH_ALGO_WP_384] = "wp384", + [HASH_ALGO_WP_512] = "wp512", + [HASH_ALGO_TGR_128] = "tgr128", + [HASH_ALGO_TGR_160] = "tgr160", + [HASH_ALGO_TGR_192] = "tgr192", + [HASH_ALGO_SM3_256] = "sm3", + [HASH_ALGO_STREEBOG_256] = "streebog256", + [HASH_ALGO_STREEBOG_512] = "streebog512", +}; + +const int hash_digest_size[HASH_ALGO__LAST] = { + [HASH_ALGO_MD4] = MD5_DIGEST_SIZE, + [HASH_ALGO_MD5] = MD5_DIGEST_SIZE, + [HASH_ALGO_SHA1] = SHA1_DIGEST_SIZE, + [HASH_ALGO_RIPE_MD_160] = RMD160_DIGEST_SIZE, + [HASH_ALGO_SHA256] = SHA256_DIGEST_SIZE, + [HASH_ALGO_SHA384] = SHA384_DIGEST_SIZE, + [HASH_ALGO_SHA512] = SHA512_DIGEST_SIZE, + [HASH_ALGO_SHA224] = SHA224_DIGEST_SIZE, + [HASH_ALGO_RIPE_MD_128] = RMD128_DIGEST_SIZE, + [HASH_ALGO_RIPE_MD_256] = RMD256_DIGEST_SIZE, + [HASH_ALGO_RIPE_MD_320] = RMD320_DIGEST_SIZE, + [HASH_ALGO_WP_256] = WP256_DIGEST_SIZE, + [HASH_ALGO_WP_384] = WP384_DIGEST_SIZE, + [HASH_ALGO_WP_512] = WP512_DIGEST_SIZE, + [HASH_ALGO_TGR_128] = TGR128_DIGEST_SIZE, + [HASH_ALGO_TGR_160] = TGR160_DIGEST_SIZE, + [HASH_ALGO_TGR_192] = TGR192_DIGEST_SIZE, + [HASH_ALGO_SM3_256] = SM3256_DIGEST_SIZE, + [HASH_ALGO_STREEBOG_256] = STREEBOG256_DIGEST_SIZE, + [HASH_ALGO_STREEBOG_512] = STREEBOG512_DIGEST_SIZE, +}; diff --git a/tools/diglim/common.h b/tools/diglim/common.h new file mode 100644 index 000000000000..d33e5082c17c --- /dev/null +++ b/tools/diglim/common.h @@ -0,0 +1,59 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) 2005,2006,2007,2008 IBM Corporation + * Copyright (C) 2017-2021 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Header of common.c + */ + +#include <sys/random.h> +#include <errno.h> +#include <stdint.h> +#include <stdlib.h> +#include <fcntl.h> +#include <ctype.h> +#include <malloc.h> +#include <unistd.h> +#include <string.h> +#include <limits.h> +#include <stdbool.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <linux/types.h> +#include <linux/hash_info.h> + +#include "../../usr/include/linux/diglim.h" + +#define MD5_DIGEST_SIZE 16 +#define SHA1_DIGEST_SIZE 20 +#define RMD160_DIGEST_SIZE 20 +#define SHA256_DIGEST_SIZE 32 +#define SHA384_DIGEST_SIZE 48 +#define SHA512_DIGEST_SIZE 64 +#define SHA224_DIGEST_SIZE 28 +#define RMD128_DIGEST_SIZE 16 +#define RMD256_DIGEST_SIZE 32 +#define RMD320_DIGEST_SIZE 40 +#define WP256_DIGEST_SIZE 32 +#define WP384_DIGEST_SIZE 48 +#define WP512_DIGEST_SIZE 64 +#define TGR128_DIGEST_SIZE 16 +#define TGR160_DIGEST_SIZE 20 +#define TGR192_DIGEST_SIZE 24 +#define SM3256_DIGEST_SIZE 32 +#define STREEBOG256_DIGEST_SIZE 32 +#define STREEBOG512_DIGEST_SIZE 64 + +#define COMPACT_LIST_SIZE_MAX (64 * 1024 * 1024 - 1) + +/* kernel types */ +typedef u_int8_t u8; +typedef u_int16_t u16; +typedef u_int32_t u32; +typedef u_int64_t u64; + +extern char *compact_types_str[COMPACT__LAST]; +extern const char *const hash_algo_name[HASH_ALGO__LAST]; +extern const int hash_digest_size[HASH_ALGO__LAST]; diff --git a/tools/diglim/compact_gen.c b/tools/diglim/compact_gen.c new file mode 100644 index 000000000000..0bfe8584de46 --- /dev/null +++ b/tools/diglim/compact_gen.c @@ -0,0 +1,349 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2017-2021 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Generate compact digest lists. + */ + +#include <stdio.h> +#include <fcntl.h> +#include <errno.h> + +#include <limits.h> +#include <openssl/sha.h> +#include <openssl/evp.h> +#include <sys/mman.h> +#include <sys/stat.h> +#include <fcntl.h> +#include <unistd.h> +#include <fts.h> +#include <string.h> +#include <getopt.h> +#include <linux/hash_info.h> +#include <bits/endianness.h> + +#if __BYTE_ORDER == __BIG_ENDIAN +#include <linux/byteorder/big_endian.h> +#else +#include <linux/byteorder/little_endian.h> +#endif + +#include "common.h" + +static int gen_filename_prefix(char *filename, int filename_len, int pos, + const char *format, enum compact_types type) +{ + return snprintf(filename, filename_len, "%d-%s_list-%s-", + (pos >= 0) ? pos : 0, compact_types_str[type], format); +} + +static int calc_digest(u8 *digest, void *data, u64 len, enum hash_algo algo) +{ + EVP_MD_CTX *mdctx; + const EVP_MD *md; + int ret = -EINVAL; + + OpenSSL_add_all_algorithms(); + + md = EVP_get_digestbyname(hash_algo_name[algo]); + if (!md) + goto out; + + mdctx = EVP_MD_CTX_create(); + if (!mdctx) + goto out; + + if (EVP_DigestInit_ex(mdctx, md, NULL) != 1) + goto out_mdctx; + + if (EVP_DigestUpdate(mdctx, data, len) != 1) + goto out_mdctx; + + if (EVP_DigestFinal_ex(mdctx, digest, NULL) != 1) + goto out_mdctx; + + ret = 0; +out_mdctx: + EVP_MD_CTX_destroy(mdctx); +out: + EVP_cleanup(); + return ret; +} + +static int calc_file_digest(u8 *digest, char *path, enum hash_algo algo) +{ + void *data = MAP_FAILED; + struct stat st; + int fd, ret = 0; + + if (stat(path, &st) == -1) + return -EACCES; + + fd = open(path, O_RDONLY); + if (fd < 0) + return -EACCES; + + if (st.st_size) { + data = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0); + if (data == MAP_FAILED) { + ret = -ENOMEM; + goto out; + } + } + + ret = calc_digest(digest, data, st.st_size, algo); +out: + if (data != MAP_FAILED) + munmap(data, st.st_size); + + close(fd); + return ret; +} + +static u8 *new_digest_list(enum hash_algo algo, enum compact_types type, + u16 modifiers) +{ + u8 *digest_list; + struct compact_list_hdr *hdr; + + digest_list = mmap(NULL, COMPACT_LIST_SIZE_MAX, PROT_READ | PROT_WRITE, + MAP_PRIVATE | MAP_ANONYMOUS, 0, 0); + if (digest_list == MAP_FAILED) { + printf("Cannot allocate buffer\n"); + return NULL; + } + + hdr = (struct compact_list_hdr *)digest_list; + memset(hdr, 0, sizeof(*hdr)); + + hdr->version = 1; + hdr->type = __cpu_to_le16(type); + hdr->modifiers = __cpu_to_le16(modifiers); + hdr->algo = __cpu_to_le16(algo); + return digest_list; +} + +static int write_digest_list(int fd, u8 *digest_list) +{ + struct compact_list_hdr *hdr; + u32 datalen; + ssize_t ret; + + hdr = (struct compact_list_hdr *)digest_list; + if (!hdr->count) + return 0; + + datalen = hdr->datalen; + hdr->count = __cpu_to_le32(hdr->count); + hdr->datalen = __cpu_to_le32(hdr->datalen); + + ret = write(fd, digest_list, sizeof(*hdr) + datalen); + if (ret != sizeof(*hdr) + datalen) + return -EIO; + + return ret; +} + +static int gen_compact_digest_list(char *input, enum hash_algo algo, + u8 *digest_list, u8 *digest_list_immutable) +{ + FTS *fts = NULL; + FTSENT *ftsent; + int fts_flags = (FTS_PHYSICAL | FTS_COMFOLLOW | FTS_NOCHDIR | FTS_XDEV); + char *paths[2] = { input, NULL }; + u8 *digest_list_ptr = digest_list; + struct compact_list_hdr *cur_hdr; + int ret; + + if (!digest_list) + digest_list_ptr = digest_list_immutable; + + fts = fts_open(paths, fts_flags, NULL); + if (!fts) { + printf("Unable to open %s\n", input); + return -EACCES; + } + + while ((ftsent = fts_read(fts)) != NULL) { + switch (ftsent->fts_info) { + case FTS_F: + if (((ftsent->fts_statp->st_mode & 0111) || + !(ftsent->fts_statp->st_mode & 0222)) && + ftsent->fts_statp->st_size) + digest_list_ptr = digest_list_immutable; + + if ((strstr(ftsent->fts_path, "/lib/modules") && + strncmp(ftsent->fts_name, "modules.", 8)) || + strstr(ftsent->fts_path, "/lib/firmware")) + digest_list_ptr = digest_list_immutable; + + cur_hdr = (struct compact_list_hdr *)digest_list_ptr; + + ret = calc_file_digest(digest_list_ptr + + sizeof(*cur_hdr) + cur_hdr->datalen, + ftsent->fts_path, algo); + if (ret < 0) { + printf("Cannot calculate digest of %s\n", + ftsent->fts_path); + continue; + } + + cur_hdr->count++; + cur_hdr->datalen += hash_digest_size[algo]; + break; + default: + break; + } + } + + return 0; +} + +static void usage(char *progname) +{ + printf("Usage: %s <options>\n", progname); + printf("Options:\n"); + printf("\t-d <output directory>: directory digest lists are written to\n" + "\t-i <path>: file/directory the digest list is generated from\n" + "\t-t <type>: type of compact list to generate\n" + "\t-a <algo>: digest algorithm\n" + "\t-f: force the digest list to be immutable\n" + "\t-h: display help\n"); +} + +int main(int argc, char *argv[]) +{ + char path[PATH_MAX]; + char filename[NAME_MAX + 1]; + char *output_dir = NULL, *input = NULL; + enum compact_types type = COMPACT_FILE; + enum hash_algo algo = HASH_ALGO_SHA256; + u8 *digest_list = NULL, *digest_list_immutable = NULL; + char *input_ptr; + struct stat st; + int c; + int ret, fd = -1, force_immutable = 0; + + while ((c = getopt(argc, argv, "d:i:t:a:fh")) != -1) { + switch (c) { + case 'd': + output_dir = optarg; + break; + case 'i': + input = optarg; + break; + case 't': + for (type = 0; type < COMPACT__LAST; type++) + if (!strcmp(compact_types_str[type], optarg)) + break; + if (type == COMPACT__LAST) { + printf("Invalid type %s\n", optarg); + exit(1); + } + break; + case 'a': + for (algo = 0; algo < HASH_ALGO__LAST; algo++) + if (!strcmp(hash_algo_name[algo], optarg)) + break; + if (algo == HASH_ALGO__LAST) { + printf("Invalid algo %s\n", optarg); + exit(1); + } + break; + case 'f': + force_immutable = 1; + break; + case 'h': + usage(argv[0]); + exit(0); + default: + printf("Invalid option %c\n", c); + exit(1); + } + } + + if (!output_dir) { + printf("Output directory not specified\n"); + exit(1); + } + + if (!input) { + printf("Input file/directory not specified\n"); + exit(1); + } + + if (stat(input, &st) == -1) { + printf("Input file/directory not found or not accessible\n"); + exit(1); + } + + if (stat(output_dir, &st) == -1) + mkdir(output_dir, 0755); + + gen_filename_prefix(filename, sizeof(filename), 0, "compact", type); + + input_ptr = strrchr(input, '/'); + if (input_ptr) + input_ptr++; + else + input_ptr = input; + + snprintf(path, sizeof(path), "%s/%s%s", output_dir, filename, + input_ptr); + + if (!force_immutable) { + digest_list = new_digest_list(algo, type, 0); + if (!digest_list) { + ret = -ENOMEM; + goto out; + } + } + + digest_list_immutable = new_digest_list(algo, type, + (1 << COMPACT_MOD_IMMUTABLE)); + if (!digest_list_immutable) { + ret = -ENOMEM; + goto out; + } + + fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644); + if (fd < 0) { + printf("Unable to create %s\n", path); + ret = -errno; + goto out; + } + + ret = gen_compact_digest_list(input, algo, digest_list, + digest_list_immutable); + if (ret < 0) { + printf("Unable to generate the digest list from %s\n", input); + goto out; + } + + if (!force_immutable) { + ret = write_digest_list(fd, digest_list); + if (ret < 0) { + printf("Unable to write the digest list to %s\n", path); + goto out; + } + } + + ret = write_digest_list(fd, digest_list_immutable); + if (ret < 0) + printf("Unable to write the digest list to %s\n", path); +out: + if (digest_list) + munmap(digest_list, COMPACT_LIST_SIZE_MAX); + if (digest_list_immutable) + munmap(digest_list_immutable, COMPACT_LIST_SIZE_MAX); + + if (fd >= 0) + close(fd); + + if (ret < 0) + unlink(path); + + return ret; +}

Introduce a digest list uploader. Its syntax is:

upload_digest_lists <add|del> <digest list file/directory>

Its main function is to determine which digest list parsers must be executed to parse the digest lists in the specified location. The uploader then executes the parsers in sequence, which are expected to be in the same directory as the uploader.

Given that this tool is not involved in the conversion of the digest lists, it does not need to be identified as a parser by DIGLIM LSM.

It is intentionally compiled as a static binary. Otherwise, a build service of a Linux distribution would need to be modified to generate a digest list for each of the shared library the uploader depends on (e.g. glibc). Instead, with a static binary, only a digest list for that binary has to be generated.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- MAINTAINERS | 1 + tools/diglim/Makefile | 5 +- tools/diglim/upload_digest_lists.c | 238 +++++++++++++++++++++++++++++ 3 files changed, 243 insertions(+), 1 deletion(-) create mode 100644 tools/diglim/upload_digest_lists.c

diff --git a/MAINTAINERS b/MAINTAINERS index 04b252ebd7e1..148a2a7957b7 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5527,6 +5527,7 @@ F: tools/diglim/common.c F: tools/diglim/common.h F: tools/diglim/compact_gen.c F: tools/diglim/rpm_gen.c +F: tools/diglim/upload_digest_lists.c F: tools/testing/selftests/diglim/

DIOLAN U2C-12 I2C DRIVER diff --git a/tools/diglim/Makefile b/tools/diglim/Makefile index 332bcd93af78..a22125ad0281 100644 --- a/tools/diglim/Makefile +++ b/tools/diglim/Makefile @@ -3,7 +3,7 @@ CC := $(CROSS_COMPILE)gcc CFLAGS += -O2 -Wall -g -I./ -I../../usr/include/ -ggdb

-PROGS := compact_gen rpm_gen +PROGS := compact_gen rpm_gen upload_digest_lists PROGS_EXTENDED := common.o

all: $(PROGS) @@ -19,3 +19,6 @@ compact_gen: compact_gen.c $(PROGS_EXTENDED)

rpm_gen: rpm_gen.c $(PROGS_EXTENDED) $(CC) $(CFLAGS) $< $(PROGS_EXTENDED) -o $@ $(LDFLAGS) -lrpm -lrpmio + +upload_digest_lists: upload_digest_lists.c + $(CC) $(CFLAGS) -static $< -o $@ $(LDFLAGS) diff --git a/tools/diglim/upload_digest_lists.c b/tools/diglim/upload_digest_lists.c new file mode 100644 index 000000000000..06086dd64aa3 --- /dev/null +++ b/tools/diglim/upload_digest_lists.c @@ -0,0 +1,238 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2017-2021 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Run parsers of digest list formats not recognizable by the kernel. + */ + +#include <stdio.h> +#include <errno.h> +#include <fts.h> +#include <string.h> +#include <stdbool.h> +#include <fcntl.h> +#include <stdlib.h> +#include <unistd.h> +#include <sys/wait.h> +#include <linux/limits.h> +#include <sys/mount.h> +#include <sys/vfs.h> +#include <sys/stat.h> +#include <linux/magic.h> + +#define MOUNT_FLAGS (MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_RELATIME) +#define PROCFS_MNTPOINT "/proc" +#define SYSFS_MNTPOINT "/sys" +#define SECURITYFS_MNTPOINT SYSFS_MNTPOINT "/kernel/security" +#define DIGLIM_DIR SECURITYFS_MNTPOINT "/integrity/diglim" + +struct format_entry { + struct format_entry *next; + char *format; +}; + +struct format_entry *head; +bool procfs_mounted; +bool sysfs_mounted; +bool securityfs_mounted; + +int add_format_parser(char *path) +{ + char *name; + char *type_start, *format_start, *format_end; + struct format_entry *cur, *new; + int ret = 0; + + name = strrchr(path, '/'); + if (!name) + return -EINVAL; + + name++; + + type_start = strchr(name, '-'); + if (!type_start++) + return 0; + + format_start = strchr(type_start, '-'); + if (!format_start++) + return 0; + + format_end = strchr(format_start, '-'); + if (!format_end) + return 0; + + if (!strncmp(format_start, "compact", format_end - format_start)) + return 0; + + cur = head; + + while (cur) { + if (!strncmp(format_start, cur->format, + format_end - format_start)) + goto out; + + cur = cur->next; + } + + new = malloc(sizeof(*new)); + if (!new) { + ret = -ENOMEM; + goto out; + } + + new->format = strndup(format_start, format_end - format_start); + if (!new->format) { + ret = -ENOMEM; + goto out; + } + + new->next = head; + head = new; +out: + if (ret < 0) + free(new); + + return ret; +} + +void free_list(void) +{ + struct format_entry *cur = head, *tmp; + + while (cur) { + tmp = cur; + cur = tmp->next; + free(tmp->format); + free(tmp); + } +} + +static int mount_filesystems(void) +{ + struct stat st; + struct statfs stf; + int ret; + + if (stat("/proc/self", &st) == -1 || + statfs("/proc/self", &stf) == -1 || stf.f_type != 0x9fa0) { + ret = mount(PROCFS_MNTPOINT, PROCFS_MNTPOINT, "proc", + MOUNT_FLAGS, NULL); + if (ret < 0) { + printf("Cannot mount procfs\n"); + return ret; + } + + procfs_mounted = true; + } + + if (stat(SECURITYFS_MNTPOINT, &st) == -1 || + statfs(SYSFS_MNTPOINT, &stf) == -1 || + stf.f_type != 0x62656572) { + ret = mount(SYSFS_MNTPOINT, SYSFS_MNTPOINT, "sysfs", + MOUNT_FLAGS, NULL); + if (ret < 0) { + printf("Cannot mount sysfs\n"); + return ret; + } + + sysfs_mounted = true; + } + + if (stat(DIGLIM_DIR, &st) == -1 || + statfs(SECURITYFS_MNTPOINT, &stf) == -1 || + stf.f_type != 0x73636673) { + ret = mount(SECURITYFS_MNTPOINT, SECURITYFS_MNTPOINT, + "securityfs", MOUNT_FLAGS, NULL); + if (ret < 0) { + printf("Cannot mount securityfs\n"); + return ret; + } + + securityfs_mounted = true; + } + + return 0; +} + +static void umount_filesystems(void) +{ + if (procfs_mounted) + umount(PROCFS_MNTPOINT); + if (securityfs_mounted) + umount(SECURITYFS_MNTPOINT); + if (sysfs_mounted) + umount(SYSFS_MNTPOINT); +} + +int main(int argc, char *argv[]) +{ + char *paths[2] = { NULL, NULL }; + struct format_entry *cur; + char parser_path[PATH_MAX], *sep; + FTS *fts = NULL; + FTSENT *ftsent; + int fts_flags = (FTS_PHYSICAL | FTS_COMFOLLOW | FTS_NOCHDIR | FTS_XDEV); + int ret; + + if (argc != 3) { + printf("Usage: %s add|del <digest list path>\n", argv[0]); + return -EINVAL; + } + + paths[0] = argv[2]; + + fts = fts_open(paths, fts_flags, NULL); + if (!fts) + return -EACCES; + + while ((ftsent = fts_read(fts)) != NULL) { + switch (ftsent->fts_info) { + case FTS_F: + ret = add_format_parser(ftsent->fts_path); + if (ret < 0) + printf("Cannot upload %s\n", ftsent->fts_path); + + break; + default: + break; + } + } + + fts_close(fts); + fts = NULL; + + ret = mount_filesystems(); + if (ret < 0) + goto out; + + ret = readlink("/proc/self/exe", parser_path, sizeof(parser_path)); + if (ret < 0) + goto out; + + sep = strrchr(parser_path, '/'); + if (!sep++) { + ret = -ENOENT; + goto out; + } + + cur = head; + + while (cur) { + if (fork() == 0) { + snprintf(sep, sizeof(parser_path) - (sep - parser_path), + "%s_parser", cur->format); + return execlp(parser_path, parser_path, argv[1], + argv[2], NULL); + } + + wait(NULL); + cur = cur->next; + } + +out: + free_list(); + umount_filesystems(); + return ret; +}

Introduce a DIGLIM administration guide. Its main purpose is to help users to configure a system to load to the kernel all the digests of executable and firmware from the RPM DB, and kernel modules of a custom kernel and a temporary file mapped as executable as custom digest lists.

With further patch sets, it will be possible to load an execution policy in IMA and create a measurement list only with digest lists and unknown files, and to perform secure boot at application level.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- Documentation/admin-guide/diglim.rst | 136 +++++++++++++++++++++++++++ Documentation/admin-guide/index.rst | 1 + MAINTAINERS | 1 + 3 files changed, 138 insertions(+) create mode 100644 Documentation/admin-guide/diglim.rst

diff --git a/Documentation/admin-guide/diglim.rst b/Documentation/admin-guide/diglim.rst new file mode 100644 index 000000000000..886100cf5a62 --- /dev/null +++ b/Documentation/admin-guide/diglim.rst @@ -0,0 +1,136 @@ +.. SPDX-License-Identifier: GPL-2.0 + +====== +DIGLIM +====== + +Digest Lists Integrity Module (DIGLIM) is an integrity extension aiming to +facilitate the deployment of remote attestation and secure boot solutions +based on Integrity Measurement Architecture (IMA). + +DIGLIM documentation can be retrieved at ``Documentation/security/diglim``. + +Kernel Configuration Options +============================ + +DIGLIM can be enabled by setting ``CONFIG_DIGLIM=y`` in the kernel +configuration. Optionally, it is possible to set +``CONFIG_DIGLIM_DIGEST_LISTS_DIR`` with the directory digest lists are +taken from by a kernel loader executed at kernel initialization time. +Finally, with ``CONFIG_DIGLIM_UPLOADER_PATH`` it is possible to specify the +path of the digest list uploader, which will execute user space parsers to +process the digest lists in ``CONFIG_DIGLIM_DIGEST_LISTS_DIR`` that are not +in the format recognized by the kernel. + + +LSM +=== + +DIGLIM includes an LSM to protect user space parsers from other processes, +when the parsers convert a digest list and uploads it to the kernel. As for +other LSMs, ``diglim`` should be added to the list of enabled LSMs, +provided with the ``lsm=`` kernel option. If DIGLIM LSM is not enabled, +digest lists uploaded by the parser will not be marked as processed by IMA +and will not be suitable for use. + + +Setup +===== + +Digest lists must be loaded as soon as possible, before files are accessed, +so that IMA finds the digest of those files with a query. More details on +the benefits of DIGLIM for IMA can be found in +``Documentation/security/diglim/introduction.rst``. + + +Digest List Generation +---------------------- + +Digest lists can be generated with the tools provided in ``tools/diglim`` +in the kernel sources. In order to compile the tools, it is necessary to +install the ``glibc-static`` and ``rpm-devel`` packages. + +``compact_gen`` can be used to generate digest lists in the compact format, +which can be directly uploaded to the kernel. + +In order to upload digests from the RPM database, it is necessary to +generate three digest lists: one for ``upload_digest_lists``, which is +responsible to execute the parsers for digest lists not in the compact +format; two for ``rpm_parser``, which actually loads the RPM digest lists. + +``rpm_parser`` requires two digest lists, one for identification by DIGLIM +LSM, and the other for measurement and appraisal with IMA. The commands +are:: + + # tools/diglim/compact_gen -d /etc/digest_lists -i /usr/libexec/diglim/rpm_parser -t parser + # tools/diglim/compact_gen -d /etc/digest_lists -i /usr/libexec/diglim/rpm_parser -t file + # tools/diglim/compact_gen -d /etc/digest_lists -i /usr/libexec/diglim/upload_digest_lists -t file + +Optionally, an appended signature can be added to the generated digest +lists, with the sign-file tool included in the kernel sources:: + + # scripts/sign-file sha256 certs/signing_key.pem certs/signing_key.pem /etc/digest_lists/0-parser_list-compact-rpm_parser + # scripts/sign-file sha256 certs/signing_key.pem certs/signing_key.pem /etc/digest_lists/0-file_list-compact-rpm_parser + # scripts/sign-file sha256 certs/signing_key.pem certs/signing_key.pem /etc/digest_lists/0-file_list-compact-upload_digest_lists + +With an appropriate policy, appended signatures can be seen in the +measurement, by selecting the ``ima-modsig`` template. + +Afterwards, digest lists can be generated from the RPM database with the +command:: + + # tools/diglim/rpm_gen -d /etc/digest_lists + +If a custom kernel is used, an additional digest list should be generated +for kernel modules:: + + # tools/diglim/compact_gen -d /etc/digest_lists -i /lib/modules/`uname -r` -t file + # scripts/sign-file sha256 certs/signing_key.pem certs/signing_key.pem /etc/digest_lists/0-file_list-compact-`uname -r` + +Finally, in Fedora there is an mmap with execution permission on a file +with 4K of zeros. A digest list can be generated by executing:: + + # dd if=/dev/zero of=/tmp/mmap bs=4096 count=1 + # tools/diglim/compact_gen -d /etc/digest_lists -i /tmp/mmap -f + # scripts/sign-file sha256 certs/signing_key.pem certs/signing_key.pem /etc/digest_lists/0-file_list-compact-mmap + + +Initial Ram Disk +---------------- + +Generated digest lists should be copied to the initial ram disk in the +``CONFIG_DIGLIM_DIGEST_LISTS_DIR`` directory. This can be accomplished, +with dracut, by adding in /etc/dracut.conf:: + + install_optional_items+=" /etc/digest_lists/* " + +if ``CONFIG_DIGLIM_DIGEST_LISTS_DIR=/etc/digest_lists``. + +``upload_digest_lists`` and ``rpm_parser`` can be also copied to the +initial ram disk by adding the following lines in /etc/dracut.conf:: + + install_optional_items+=" /usr/libexec/diglim/upload_digest_lists " + install_optional_items+=" /usr/libexec/diglim/rpm_parser " + +assuming that the binaries are installed in /usr/libexec/diglim. + +Another important option is:: + + do_strip="no" + +This prevents dracut from stripping the symbols from binaries. If binaries +are altered, their digest will be different from the reference value and +will not be found in the DIGLIM hash table. + + +Boot and Digest List Upload +--------------------------- + +After generating the initial ram disk and rebooting, digest lists should +have been added to the DIGLIM hash table. This can be checked by executing:: + + # cat /sys/kernel/security/integrity/diglim/digests_count + Parser digests: 1 + File digests: 104273 + Metadata digests: 0 + Digest list digests: 2430 diff --git a/Documentation/admin-guide/index.rst b/Documentation/admin-guide/index.rst index dc00afcabb95..1cc7d3b3e79c 100644 --- a/Documentation/admin-guide/index.rst +++ b/Documentation/admin-guide/index.rst @@ -79,6 +79,7 @@ configure specific aspects of kernel behavior to your liking. cputopology dell_rbu device-mapper/index + diglim edid efi-stub ext4 diff --git a/MAINTAINERS b/MAINTAINERS index 1efc1724376e..953c86915c49 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5507,6 +5507,7 @@ M: Roberto Sassu roberto.sassu@huawei.com L: linux-integrity@vger.kernel.org S: Supported T: git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git +F: Documentation/admin-guide/diglim.rst F: Documentation/security/diglim/architecture.rst F: Documentation/security/diglim/implementation.rst F: Documentation/security/diglim/index.rst