On Mon Apr 15, 2024 at 5:24 PM EEST, Roberto Sassu wrote:

From: Roberto Sassu roberto.sassu@huawei.com

Introduce the digest_cache LSM, to collect digests from various sources (called digest lists), and to store them in kernel memory, in a set of hash tables forming a digest cache. Extracted digests can be used as reference values for integrity verification of file data or metadata.

A digest cache has three types of references: in the inode security blob of the digest list the digest cache was created from (dig_owner field); in the security blob of the inodes for which the digest cache is requested (dig_user field); a reference returned by digest_cache_get().

References are released with digest_cache_put(), in the first two cases when inodes are evicted from memory, in the last case when that function is explicitly called. Obtaining a digest cache reference means that the digest cache remains valid and cannot be freed until releasing it and until the total number of references (stored in the digest cache) becomes zero.

When digest_cache_get() is called on an inode to compare its digest with a reference value, the digest_cache LSM knows which digest cache to get from the new security.digest_list xattr added to that inode, which contains the file name of the desired digest list digests will be extracted from.

All digest lists are expected to be in the same directory, defined in the kernel config, and modifiable (with a later patch) at run-time through securityfs. When the digest_cache LSM reads the security.digest_list xattr, it uses its value as last path component, appended to the default path (unless the default path is a file). If an inode does not have that xattr, the default path is considered as the final destination.

The default path can be either a file or a directory. If it is a file, the digest_cache LSM always uses the same digest cache from that file to verify all inodes (the xattr, if present, is ignored). If it is a directory, and the inode to verify does not have the xattr, a subsequent patch will make it possible to iterate and lookup on the digest caches created from each directory entry.

Digest caches are created on demand, only when digest_cache_get() is called. The first time a digest cache is requested, the digest_cache LSM creates it and sets its reference in the dig_owner and dig_user fields of the respective inode security blobs. On the next requests, the previously set reference is returned, after incrementing the reference count.

Since there might be multiple digest_cache_get() calls for the same inode, or for different inodes pointing to the same digest list, dig_owner_mutex and dig_user_mutex have been introduced to protect the check and assignment of the digest cache reference in the inode security blob.

Contenders that didn't get the lock also have to wait until the digest cache is fully instantiated (when the bit INIT_IN_PROGRESS is cleared). Dig_owner_mutex cannot be used for waiting on the instantiation to avoid lock inversion with the inode lock for directories.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com

MAINTAINERS | 6 + include/linux/digest_cache.h | 32 ++ include/uapi/linux/lsm.h | 1 + include/uapi/linux/xattr.h | 3 + security/Kconfig | 11 +- security/Makefile | 1 + security/digest_cache/Kconfig | 16 + security/digest_cache/Makefile | 7 + security/digest_cache/internal.h | 86 ++++ security/digest_cache/main.c | 404 ++++++++++++++++++ security/security.c | 3 +- .../selftests/lsm/lsm_list_modules_test.c | 3 + 12 files changed, 567 insertions(+), 6 deletions(-) create mode 100644 include/linux/digest_cache.h create mode 100644 security/digest_cache/Kconfig create mode 100644 security/digest_cache/Makefile create mode 100644 security/digest_cache/internal.h create mode 100644 security/digest_cache/main.c

diff --git a/MAINTAINERS b/MAINTAINERS index b1ca23ab8732..72801a88449c 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -6193,6 +6193,12 @@ L: linux-gpio@vger.kernel.org S: Maintained F: drivers/gpio/gpio-gpio-mm.c +DIGEST_CACHE LSM +M: Roberto Sassu roberto.sassu@huawei.com +L: linux-security-module@vger.kernel.org +S: Maintained +F: security/digest_cache/

DIGITEQ AUTOMOTIVE MGB4 V4L2 DRIVER M: Martin Tuma martin.tuma@digiteqautomotive.com L: linux-media@vger.kernel.org

Nit: afaik, MAINTAINER updates should be split.

diff --git a/include/linux/digest_cache.h b/include/linux/digest_cache.h new file mode 100644 index 000000000000..e79f94a60b0f --- /dev/null +++ b/include/linux/digest_cache.h @@ -0,0 +1,32 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com

Nit: Git has an author field in commit granularity so adding author fields to files is sort of old world.

• • Public API of the digest_cache LSM.
• */

+#ifndef _LINUX_DIGEST_CACHE_H +#define _LINUX_DIGEST_CACHE_H

+#include <linux/fs.h>

+struct digest_cache;

Is this declaration necessary?

I don't think you need forward declaration here as this does compile:

#include <stdio.h>

struct digest_cache *digest_cache_get(void) { return NULL; }

int main(void) { return (long)digest_cache_get(); }

+#ifdef CONFIG_SECURITY_DIGEST_CACHE +struct digest_cache *digest_cache_get(struct dentry *dentry); +void digest_cache_put(struct digest_cache *digest_cache);

+#else +static inline struct digest_cache *digest_cache_get(struct dentry *dentry) +{

• return NULL;

+}

+static inline void digest_cache_put(struct digest_cache *digest_cache) +{ +}

+#endif /* CONFIG_SECURITY_DIGEST_CACHE */ +#endif /* _LINUX_DIGEST_CACHE_H */ diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h index 33d8c9f4aa6b..832b3aea5c26 100644 --- a/include/uapi/linux/lsm.h +++ b/include/uapi/linux/lsm.h @@ -64,6 +64,7 @@ struct lsm_ctx { #define LSM_ID_LANDLOCK 110 #define LSM_ID_IMA 111 #define LSM_ID_EVM 112 +#define LSM_ID_DIGEST_CACHE 113 /*

• LSM_ATTR_XXX definitions identify different LSM attributes

diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h index 9463db2dfa9d..8a58cf4bce65 100644 --- a/include/uapi/linux/xattr.h +++ b/include/uapi/linux/xattr.h @@ -54,6 +54,9 @@ #define XATTR_IMA_SUFFIX "ima" #define XATTR_NAME_IMA XATTR_SECURITY_PREFIX XATTR_IMA_SUFFIX +#define XATTR_DIGEST_LIST_SUFFIX "digest_list" +#define XATTR_NAME_DIGEST_LIST XATTR_SECURITY_PREFIX XATTR_DIGEST_LIST_SUFFIX

#define XATTR_SELINUX_SUFFIX "selinux" #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX diff --git a/security/Kconfig b/security/Kconfig index 52c9af08ad35..99f99cbd94cc 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -194,6 +194,7 @@ source "security/yama/Kconfig" source "security/safesetid/Kconfig" source "security/lockdown/Kconfig" source "security/landlock/Kconfig" +source "security/digest_cache/Kconfig" source "security/integrity/Kconfig" @@ -233,11 +234,11 @@ endchoice config LSM string "Ordered list of enabled LSMs"

• default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK
• default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR
• default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO
• default "landlock,lockdown,yama,loadpin,safesetid,bpf" if DEFAULT_SECURITY_DAC
• default "landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf"

• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,bpf" if DEFAULT_SECURITY_DAC
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf" help A comma-separated list of LSMs, in initialization order. Any LSMs left off this list, except for those with order

diff --git a/security/Makefile b/security/Makefile index 59f238490665..e9b43e7b715a 100644 --- a/security/Makefile +++ b/security/Makefile @@ -25,6 +25,7 @@ obj-$(CONFIG_SECURITY_LOCKDOWN_LSM) += lockdown/ obj-$(CONFIG_CGROUPS) += device_cgroup.o obj-$(CONFIG_BPF_LSM) += bpf/ obj-$(CONFIG_SECURITY_LANDLOCK) += landlock/ +obj-$(CONFIG_SECURITY_DIGEST_CACHE) += digest_cache/ # Object integrity file lists obj-$(CONFIG_INTEGRITY) += integrity/ diff --git a/security/digest_cache/Kconfig b/security/digest_cache/Kconfig new file mode 100644 index 000000000000..e53fbf0779d6 --- /dev/null +++ b/security/digest_cache/Kconfig @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: GPL-2.0 +config SECURITY_DIGEST_CACHE

• bool "Digest_cache LSM"
• default n
• help

•  This option enables an LSM maintaining a cache of digests
  

•  (e.g. of file data or metadata).
  

•  This LSM can support other kernel components in making access
  

•  control decisions.
  

+config DIGEST_LIST_DEFAULT_PATH

• string
• default "/etc/digest_lists"
• help

•  Default directory where digest_cache LSM expects to find digest lists.
  

diff --git a/security/digest_cache/Makefile b/security/digest_cache/Makefile new file mode 100644 index 000000000000..48848c41253e --- /dev/null +++ b/security/digest_cache/Makefile @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Makefile for building the digest_cache LSM.

+obj-$(CONFIG_SECURITY_DIGEST_CACHE) += digest_cache.o

+digest_cache-y := main.o diff --git a/security/digest_cache/internal.h b/security/digest_cache/internal.h new file mode 100644 index 000000000000..5f04844af3a5 --- /dev/null +++ b/security/digest_cache/internal.h @@ -0,0 +1,86 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com

ditto

• • Internal header of the digest_cache LSM.
• */

+#ifndef _DIGEST_CACHE_INTERNAL_H +#define _DIGEST_CACHE_INTERNAL_H

+#include <linux/lsm_hooks.h> +#include <linux/digest_cache.h>

+/* Digest cache bits in flags. */ +#define INIT_IN_PROGRESS 0 /* Digest cache being initialized. */

+/**

• • struct digest_cache - Digest cache
• • @ref_count: Number of references to the digest cache
• • @path_str: Path of the digest list the digest cache was created from
• • @flags: Control flags
• • This structure represents a cache of digests extracted from a digest list.
• */

+struct digest_cache {

• atomic_t ref_count;
• char *path_str;
• unsigned long flags;

+};

+/**

• • struct digest_cache_security - Digest cache pointers in inode security blob
• • @dig_owner: Digest cache created from this inode
• • @dig_owner_mutex: Protects @dig_owner
• • @dig_user: Digest cache requested for this inode
• • @dig_user_mutex: Protects @dig_user
• • This structure contains references to digest caches, protected by their
• • respective mutex.
• */

+struct digest_cache_security {

• struct digest_cache *dig_owner;
• struct mutex dig_owner_mutex;
• struct digest_cache *dig_user;
• struct mutex dig_user_mutex;

+};

+extern struct lsm_blob_sizes digest_cache_blob_sizes; +extern char *default_path_str;

+static inline struct digest_cache_security * +digest_cache_get_security(const struct inode *inode) +{

• if (unlikely(!inode->i_security))

• return NULL;
  

• return inode->i_security + digest_cache_blob_sizes.lbs_inode;

+}

+static inline struct digest_cache * +digest_cache_ref(struct digest_cache *digest_cache) +{

• atomic_inc(&digest_cache->ref_count);
• pr_debug("Ref (+) digest cache %s (ref count: %d)\n",

•  digest_cache->path_str, atomic_read(&digest_cache->ref_count));
  

• return digest_cache;

+}

+static inline struct digest_cache * +digest_cache_unref(struct digest_cache *digest_cache) +{

• bool ref_is_zero = atomic_dec_and_test(&digest_cache->ref_count);
• pr_debug("Ref (-) digest cache %s (ref count: %d)\n",

•  digest_cache->path_str, atomic_read(&digest_cache->ref_count));
  

• return (ref_is_zero) ? digest_cache : NULL;

+}

+/* main.c */ +struct digest_cache *digest_cache_create(struct dentry *dentry,

• 			 struct path *digest_list_path,
  

• 			 char *path_str, char *filename);
  

+#endif /* _DIGEST_CACHE_INTERNAL_H */ diff --git a/security/digest_cache/main.c b/security/digest_cache/main.c new file mode 100644 index 000000000000..14dba8915e99 --- /dev/null +++ b/security/digest_cache/main.c @@ -0,0 +1,404 @@ +// SPDX-License-Identifier: GPL-2.0 +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com
• • Implement the main code of the digest_cache LSM.
• */

+#define pr_fmt(fmt) "DIGEST CACHE: "fmt +#include <linux/namei.h> +#include <linux/xattr.h>

+#include "internal.h"

+static int digest_cache_enabled __ro_after_init = 1; +static struct kmem_cache *digest_cache_cache __read_mostly;

+char *default_path_str = CONFIG_DIGEST_LIST_DEFAULT_PATH;

+/**

• • digest_cache_alloc_init - Allocate and initialize a new digest cache
• • @path_str: Path string of the digest list
• • @filename: Digest list file name (can be an empty string)
• • This function allocates and initializes a new digest cache.
• • Return: A digest_cache structure on success, NULL on error.
• */

+static struct digest_cache *digest_cache_alloc_init(char *path_str,

• 				    char *filename)
  

+{

• struct digest_cache *digest_cache;
• digest_cache = kmem_cache_alloc(digest_cache_cache, GFP_KERNEL);
• if (!digest_cache)

• return digest_cache;
  

• digest_cache->path_str = kasprintf(GFP_KERNEL, "%s%s%s", path_str,

• 			   filename[0] ? "/" : "", filename);
  

• if (!digest_cache->path_str) {

• kmem_cache_free(digest_cache_cache, digest_cache);
  

• return NULL;
  

• }
• atomic_set(&digest_cache->ref_count, 1);
• digest_cache->flags = 0UL;
• pr_debug("New digest cache %s (ref count: %d)\n",

•  digest_cache->path_str, atomic_read(&digest_cache->ref_count));
  

Nit: kretprobe can be used to grab the same information easil and do e.g. statistics and stuff like that. Traces for return values are not very useful.

• return digest_cache;

+}

+/**

• • digest_cache_free - Free all memory occupied by the digest cache
• • @digest_cache: Digest cache
• • This function frees the memory occupied by the digest cache.
• */

+static void digest_cache_free(struct digest_cache *digest_cache) +{

• pr_debug("Freed digest cache %s\n", digest_cache->path_str);

ditto for the above trace

• kfree(digest_cache->path_str);
• kmem_cache_free(digest_cache_cache, digest_cache);

+}

+/**

• • digest_cache_create - Create a digest cache
• • @dentry: Dentry of the inode for which the digest cache will be used
• • @digest_list_path: Path structure of the digest list
• • @path_str: Path string of the digest list
• • @filename: Digest list file name (can be an empty string)
• • This function first locates, from the passed path, the digest list inode
• • from which the digest cache will be created or retrieved (if it already
• • exists).
• • If dig_owner is NULL in the inode security blob, this function creates a
• • new digest cache with reference count set to 1 (reference returned), sets
• • it to dig_owner and consequently increments again the digest cache reference
• • count.
• • Otherwise, it simply increments the reference count of the existing
• • dig_owner, since that reference is returned to the caller.
• • Incrementing the reference count twice before calling path_put() ensures
• • that the digest cache returned is valid even if the inode is evicted from
• • memory (which decreases the reference count).
• • Releasing the dig_owner_mutex lock does not mean that the digest cache is
• • ready for use. digest_cache_create() callers that found a partially
• • instantiated digest cache have to wait until the INIT_IN_PROGRESS bit is
• • cleared by the caller that is actually creating that digest cache.
• • Return: A new digest cache on success, NULL on error.
• */

+struct digest_cache *digest_cache_create(struct dentry *dentry,

• 			 struct path *digest_list_path,
  

• 			 char *path_str, char *filename)
  

+{

• struct path file_path;
• struct digest_cache *digest_cache = NULL;
• struct digest_cache_security *dig_sec;
• struct inode *inode = d_backing_inode(digest_list_path->dentry);
• bool dig_owner_exists = false;
• int ret;
• if (S_ISDIR(d_backing_inode(digest_list_path->dentry)->i_mode) &&

•    filename[0]) {
  

• ret = vfs_path_lookup(digest_list_path->dentry,
  

• 		      digest_list_path->mnt, filename, 0,
  

• 		      &file_path);
  

• if (ret < 0) {
  

• 	pr_debug("Cannot find digest list %s/%s\n", path_str,
  

• 		 filename);
  

• 	return NULL;
  

• }
  

• digest_list_path = &file_path;
  

• inode = d_backing_inode(file_path.dentry);
  

• /*
  

•  * Cannot request a digest cache for the same inode the
  

•  * digest cache is populated from.
  

•  */
  

• if (d_backing_inode(dentry) == inode) {
  

• 	pr_debug("Cannot request a digest cache for %s and use it as digest list\n",
  

• 		 dentry->d_name.name);
  

• 	goto out;
  

• }
  

• /* No support for nested directories. */
  

• if (!S_ISREG(inode->i_mode)) {
  

• 	pr_debug("%s is not a regular file (no support for nested directories)\n",
  

• 		 dentry->d_name.name);
  

• 	goto out;
  

• }
  

• }
• dig_sec = digest_cache_get_security(inode);
• if (unlikely(!dig_sec))

• goto out;
  

• /* Serialize check and assignment of dig_owner. */
• mutex_lock(&dig_sec->dig_owner_mutex);
• if (dig_sec->dig_owner) {

• /* Increment ref. count for reference returned to the caller. */
  

• digest_cache = digest_cache_ref(dig_sec->dig_owner);
  

• dig_owner_exists = true;
  

• mutex_unlock(&dig_sec->dig_owner_mutex);
  

• goto exists;
  

• }
• /* Ref. count is already 1 for this reference. */
• digest_cache = digest_cache_alloc_init(path_str, filename);
• if (!digest_cache) {

• mutex_unlock(&dig_sec->dig_owner_mutex);
  

• goto out;
  

• }
• /* Increment ref. count for reference set to dig_owner. */
• dig_sec->dig_owner = digest_cache_ref(digest_cache);
• /* Make the other lock contenders wait until creation complete. */
• set_bit(INIT_IN_PROGRESS, &dig_sec->dig_owner->flags);
• mutex_unlock(&dig_sec->dig_owner_mutex);
• /* Creation complete, notify the other lock contenders. */
• clear_and_wake_up_bit(INIT_IN_PROGRESS, &dig_sec->dig_owner->flags);

+exists:

• if (dig_owner_exists)

• /* Wait until creation complete. */
  

• wait_on_bit(&dig_sec->dig_owner->flags, INIT_IN_PROGRESS,
  

• 	    TASK_UNINTERRUPTIBLE);
  

+out:

• if (digest_list_path == &file_path)

• path_put(&file_path);
  

• return digest_cache;

+}

+/**

• • digest_cache_new - Retrieve digest list file name and request digest cache
• • @dentry: Dentry of the inode for which the digest cache will be used
• • This function locates the default path. If it is a file, it directly creates
• • a digest cache from it. Otherwise, it reads the digest list file name from
• • the security.digest_list xattr and requests the creation of a digest cache
• • with that file name. If security.digest_list is not found, this function
• • requests the creation of a digest cache on the parent directory.
• • Return: A new digest cache on success, NULL on error.
• */

+static struct digest_cache *digest_cache_new(struct dentry *dentry) +{

• char filename[NAME_MAX + 1] = { 0 };
• struct digest_cache *digest_cache = NULL;
• struct path default_path;
• int ret;
• ret = kern_path(default_path_str, 0, &default_path);
• if (ret < 0) {

• pr_debug("Cannot find path %s\n", default_path_str);
  

• return NULL;
  

• }
• /* The default path is a file, no need to get xattr. */
• if (S_ISREG(d_backing_inode(default_path.dentry)->i_mode)) {

• pr_debug("Default path %s is a file, not reading %s xattr\n",
  

• 	 default_path_str, XATTR_NAME_DIGEST_LIST);
  

• goto create;
  

• } else if (!S_ISDIR(d_backing_inode(default_path.dentry)->i_mode)) {

• pr_debug("Default path %s must be either a file or a directory\n",
  

• 	 default_path_str);
  

• goto out;
  

• }
• ret = vfs_getxattr(&nop_mnt_idmap, dentry, XATTR_NAME_DIGEST_LIST,

• 	   filename, sizeof(filename) - 1);
  

• if (ret <= 0) {

• pr_debug("Digest list path not found for file %s, using %s\n",
  

• 	 dentry->d_name.name, default_path_str);
  

• goto create;
  

• }
• if (strchr(filename, '/')) {

• pr_debug("%s xattr should contain only a file name, got: %s\n",
  

• 	 XATTR_NAME_DIGEST_LIST, filename);
  

• goto out;
  

• }
• pr_debug("Found %s xattr in %s, default path: %s, digest list: %s\n",

•  XATTR_NAME_DIGEST_LIST, dentry->d_name.name, default_path_str,
  

•  filename);
  

+create:

• digest_cache = digest_cache_create(dentry, &default_path,

• 			   default_path_str, filename);
  

+out:

• path_put(&default_path);
• return digest_cache;

+}

+/**

• • digest_cache_get - Get a digest cache for a given inode
• • @dentry: Dentry of the inode for which the digest cache will be used
• • This function tries to find a digest cache from the inode security blob of
• • the passed dentry (dig_user field). If a digest cache was not found, it calls
• • digest_cache_new() to create a new one. In both cases, it increments the
• • digest cache reference count before returning the reference to the caller.
• • The caller is responsible to call digest_cache_put() to release the digest
• • cache reference returned.
• • Lock dig_user_mutex to protect against concurrent requests to obtain a digest
• • cache for the same inode, and to make other contenders wait until the first
• • requester finishes the process.
• • Return: A digest cache on success, NULL otherwise.
• */

+struct digest_cache *digest_cache_get(struct dentry *dentry) +{

• struct digest_cache_security *dig_sec;
• struct digest_cache *digest_cache = NULL;
• struct inode *inode = d_backing_inode(dentry);
• if (!digest_cache_enabled)

• return NULL;
  

• dig_sec = digest_cache_get_security(inode);
• if (unlikely(!dig_sec))

• return NULL;
  

• /* Serialize accesses to inode for which the digest cache is used. */
• mutex_lock(&dig_sec->dig_user_mutex);
• if (!dig_sec->dig_user)

• /* Consume extra reference from digest_cache_create(). */
  

• dig_sec->dig_user = digest_cache_new(dentry);
  

• if (dig_sec->dig_user)

• /* Increment ref. count for reference returned to the caller. */
  

• digest_cache = digest_cache_ref(dig_sec->dig_user);
  

• mutex_unlock(&dig_sec->dig_user_mutex);
• return digest_cache;

+} +EXPORT_SYMBOL_GPL(digest_cache_get);

+/**

• • digest_cache_put - Release a digest cache reference
• • @digest_cache: Digest cache
• • This function decrements the reference count of the digest cache passed as
• • argument. If the reference count reaches zero, it calls digest_cache_free()
• • to free the digest cache.
• */

+void digest_cache_put(struct digest_cache *digest_cache) +{

• struct digest_cache *to_free;
• to_free = digest_cache_unref(digest_cache);
• if (!to_free)

• return;
  

• digest_cache_free(to_free);

+} +EXPORT_SYMBOL_GPL(digest_cache_put);

+struct lsm_blob_sizes digest_cache_blob_sizes __ro_after_init = {

• .lbs_inode = sizeof(struct digest_cache_security),

+};

+/**

• • digest_cache_inode_alloc_security - Initialize inode security blob
• • @inode: Inode for which the security blob is initialized
• • This function initializes the digest_cache_security structure, directly
• • stored in the inode security blob.
• • Return: Zero.
• */

+static int digest_cache_inode_alloc_security(struct inode *inode) +{

• struct digest_cache_security *dig_sec;
• /* The inode security blob is always allocated here. */
• dig_sec = digest_cache_get_security(inode);
• mutex_init(&dig_sec->dig_owner_mutex);
• mutex_init(&dig_sec->dig_user_mutex);
• return 0;

+}

+/**

• • digest_cache_inode_free_security - Release the digest cache references
• • @inode: Inode for which the digest cache references are released
• • Since the inode is being evicted, this function releases the non-needed
• • references to the digest caches stored in the digest_cache_security
• • structure.
• */

+static void digest_cache_inode_free_security(struct inode *inode) +{

• struct digest_cache_security *dig_sec;
• dig_sec = digest_cache_get_security(inode);
• if (!dig_sec)

• return;
  

• mutex_destroy(&dig_sec->dig_owner_mutex);
• mutex_destroy(&dig_sec->dig_user_mutex);
• if (dig_sec->dig_owner)

• digest_cache_put(dig_sec->dig_owner);
  

• if (dig_sec->dig_user)

• digest_cache_put(dig_sec->dig_user);
  

+}

+static struct security_hook_list digest_cache_hooks[] __ro_after_init = {

• LSM_HOOK_INIT(inode_alloc_security, digest_cache_inode_alloc_security),
• LSM_HOOK_INIT(inode_free_security, digest_cache_inode_free_security),

+};

+/**

• • digest_cache_init_once - Initialize the digest cache structure
• • @foo: Digest cache structure to initialize
• • This function fills the digest cache structure with zeros.
• */

+static void digest_cache_init_once(void *foo) +{

• struct digest_cache *digest_cache = (struct digest_cache *)foo;
• memset(digest_cache, 0, sizeof(*digest_cache));

+}

+static const struct lsm_id digest_cache_lsmid = {

• .name = "digest_cache",
• .id = LSM_ID_DIGEST_CACHE,

+};

+/**

• • digest_cache_init - Initialize the digest_cache LSM
• • Initialize the digest_cache LSM, by instantiating a cache for the
• • digest_cache structure and by registering the digest_cache LSM hooks.
• */

+static int __init digest_cache_init(void) +{

• digest_cache_cache = kmem_cache_create("digest_cache_cache",

• 			       sizeof(struct digest_cache),
  

• 			       0, SLAB_PANIC,
  

• 			       digest_cache_init_once);
  

• security_add_hooks(digest_cache_hooks, ARRAY_SIZE(digest_cache_hooks),

• 	   &digest_cache_lsmid);
  

• return 0;

+}

+DEFINE_LSM(digest_cache) = {

• .name = "digest_cache",
• .enabled = &digest_cache_enabled,
• .init = digest_cache_init,
• .blobs = &digest_cache_blob_sizes,

+}; diff --git a/security/security.c b/security/security.c index cbdc9bebe802..cb084ed58617 100644 --- a/security/security.c +++ b/security/security.c @@ -50,7 +50,8 @@ (IS_ENABLED(CONFIG_BPF_LSM) ? 1 : 0) + \ (IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0) + \ (IS_ENABLED(CONFIG_IMA) ? 1 : 0) + \

• (IS_ENABLED(CONFIG_EVM) ? 1 : 0))

• (IS_ENABLED(CONFIG_EVM) ? 1 : 0) + \
• (IS_ENABLED(CONFIG_SECURITY_DIGEST_CACHE) ? 1 : 0))

/*

• These are descriptions of the reasons that can be passed to the

diff --git a/tools/testing/selftests/lsm/lsm_list_modules_test.c b/tools/testing/selftests/lsm/lsm_list_modules_test.c index 4d5d4cee2586..d00831edc582 100644 --- a/tools/testing/selftests/lsm/lsm_list_modules_test.c +++ b/tools/testing/selftests/lsm/lsm_list_modules_test.c @@ -128,6 +128,9 @@ TEST(correct_lsm_list_modules) case LSM_ID_EVM: name = "evm"; break;

• case LSM_ID_DIGEST_CACHE:
  

• 	name = "digest_cache";
  

• 	break;
  

  default: name = "INVALID"; break;

BR, Jarkko

On Tue Apr 16, 2024 at 10:09 AM EEST, Roberto Sassu wrote:

On Mon, 2024-04-15 at 22:31 +0300, Jarkko Sakkinen wrote:

...

On Mon Apr 15, 2024 at 5:24 PM EEST, Roberto Sassu wrote:

...

From: Roberto Sassu roberto.sassu@huawei.com

Introduce the digest_cache LSM, to collect digests from various sources (called digest lists), and to store them in kernel memory, in a set of hash tables forming a digest cache. Extracted digests can be used as reference values for integrity verification of file data or metadata.

A digest cache has three types of references: in the inode security blob of the digest list the digest cache was created from (dig_owner field); in the security blob of the inodes for which the digest cache is requested (dig_user field); a reference returned by digest_cache_get().

References are released with digest_cache_put(), in the first two cases when inodes are evicted from memory, in the last case when that function is explicitly called. Obtaining a digest cache reference means that the digest cache remains valid and cannot be freed until releasing it and until the total number of references (stored in the digest cache) becomes zero.

When digest_cache_get() is called on an inode to compare its digest with a reference value, the digest_cache LSM knows which digest cache to get from the new security.digest_list xattr added to that inode, which contains the file name of the desired digest list digests will be extracted from.

All digest lists are expected to be in the same directory, defined in the kernel config, and modifiable (with a later patch) at run-time through securityfs. When the digest_cache LSM reads the security.digest_list xattr, it uses its value as last path component, appended to the default path (unless the default path is a file). If an inode does not have that xattr, the default path is considered as the final destination.

The default path can be either a file or a directory. If it is a file, the digest_cache LSM always uses the same digest cache from that file to verify all inodes (the xattr, if present, is ignored). If it is a directory, and the inode to verify does not have the xattr, a subsequent patch will make it possible to iterate and lookup on the digest caches created from each directory entry.

Digest caches are created on demand, only when digest_cache_get() is called. The first time a digest cache is requested, the digest_cache LSM creates it and sets its reference in the dig_owner and dig_user fields of the respective inode security blobs. On the next requests, the previously set reference is returned, after incrementing the reference count.

Since there might be multiple digest_cache_get() calls for the same inode, or for different inodes pointing to the same digest list, dig_owner_mutex and dig_user_mutex have been introduced to protect the check and assignment of the digest cache reference in the inode security blob.

Contenders that didn't get the lock also have to wait until the digest cache is fully instantiated (when the bit INIT_IN_PROGRESS is cleared). Dig_owner_mutex cannot be used for waiting on the instantiation to avoid lock inversion with the inode lock for directories.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com

MAINTAINERS | 6 + include/linux/digest_cache.h | 32 ++ include/uapi/linux/lsm.h | 1 + include/uapi/linux/xattr.h | 3 + security/Kconfig | 11 +- security/Makefile | 1 + security/digest_cache/Kconfig | 16 + security/digest_cache/Makefile | 7 + security/digest_cache/internal.h | 86 ++++ security/digest_cache/main.c | 404 ++++++++++++++++++ security/security.c | 3 +- .../selftests/lsm/lsm_list_modules_test.c | 3 + 12 files changed, 567 insertions(+), 6 deletions(-) create mode 100644 include/linux/digest_cache.h create mode 100644 security/digest_cache/Kconfig create mode 100644 security/digest_cache/Makefile create mode 100644 security/digest_cache/internal.h create mode 100644 security/digest_cache/main.c

diff --git a/MAINTAINERS b/MAINTAINERS index b1ca23ab8732..72801a88449c 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -6193,6 +6193,12 @@ L: linux-gpio@vger.kernel.org S: Maintained F: drivers/gpio/gpio-gpio-mm.c +DIGEST_CACHE LSM +M: Roberto Sassu roberto.sassu@huawei.com +L: linux-security-module@vger.kernel.org +S: Maintained +F: security/digest_cache/

DIGITEQ AUTOMOTIVE MGB4 V4L2 DRIVER M: Martin Tuma martin.tuma@digiteqautomotive.com L: linux-media@vger.kernel.org

Nit: afaik, MAINTAINER updates should be split.

Ok, didn't know...

Yeah, it makes sense when you think it as a contract (or similar) that you commit maintaining the full set of changes.

...

...

diff --git a/include/linux/digest_cache.h b/include/linux/digest_cache.h new file mode 100644 index 000000000000..e79f94a60b0f --- /dev/null +++ b/include/linux/digest_cache.h @@ -0,0 +1,32 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com

Nit: Git has an author field in commit granularity so adding author fields to files is sort of old world.

Still like it if you don't mind...

What happens when you get the source code from non-git?

Not strongly opposing this this but over time there will be multiple contributors, which maps to multiple authors. Any company trusting just what says in the header is probably missing a legal department.

...

...

• • Public API of the digest_cache LSM.
• */

+#ifndef _LINUX_DIGEST_CACHE_H +#define _LINUX_DIGEST_CACHE_H

+#include <linux/fs.h>

+struct digest_cache;

Is this declaration necessary?

I thought so. Users of the digest_cache LSM do:

struct digest_cache *digest_cache;

digest_cache = digest_cache_get(dentry);

and so on. Those users don't know the internal layout of the digest_cache structure, but still pass it to the various functions.

According to my test this also fully works:

#include <stdio.h>

struct digest_cache *digest_cache_get(void) { return NULL; }

int main(void) { struct digest_cache *foo;

foo = digest_cache_get();

return 0; }

...

I don't think you need forward declaration here as this does compile:

#include <stdio.h>

struct digest_cache *digest_cache_get(void) { return NULL; }

int main(void) { return (long)digest_cache_get(); }

...

+#ifdef CONFIG_SECURITY_DIGEST_CACHE +struct digest_cache *digest_cache_get(struct dentry *dentry); +void digest_cache_put(struct digest_cache *digest_cache);

+#else +static inline struct digest_cache *digest_cache_get(struct dentry *dentry) +{

• return NULL;

+}

+static inline void digest_cache_put(struct digest_cache *digest_cache) +{ +}

+#endif /* CONFIG_SECURITY_DIGEST_CACHE */ +#endif /* _LINUX_DIGEST_CACHE_H */ diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h index 33d8c9f4aa6b..832b3aea5c26 100644 --- a/include/uapi/linux/lsm.h +++ b/include/uapi/linux/lsm.h @@ -64,6 +64,7 @@ struct lsm_ctx { #define LSM_ID_LANDLOCK 110 #define LSM_ID_IMA 111 #define LSM_ID_EVM 112 +#define LSM_ID_DIGEST_CACHE 113 /*

• LSM_ATTR_XXX definitions identify different LSM attributes

diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h index 9463db2dfa9d..8a58cf4bce65 100644 --- a/include/uapi/linux/xattr.h +++ b/include/uapi/linux/xattr.h @@ -54,6 +54,9 @@ #define XATTR_IMA_SUFFIX "ima" #define XATTR_NAME_IMA XATTR_SECURITY_PREFIX XATTR_IMA_SUFFIX +#define XATTR_DIGEST_LIST_SUFFIX "digest_list" +#define XATTR_NAME_DIGEST_LIST XATTR_SECURITY_PREFIX XATTR_DIGEST_LIST_SUFFIX

#define XATTR_SELINUX_SUFFIX "selinux" #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX diff --git a/security/Kconfig b/security/Kconfig index 52c9af08ad35..99f99cbd94cc 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -194,6 +194,7 @@ source "security/yama/Kconfig" source "security/safesetid/Kconfig" source "security/lockdown/Kconfig" source "security/landlock/Kconfig" +source "security/digest_cache/Kconfig" source "security/integrity/Kconfig" @@ -233,11 +234,11 @@ endchoice config LSM string "Ordered list of enabled LSMs"

• default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK
• default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR
• default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO
• default "landlock,lockdown,yama,loadpin,safesetid,bpf" if DEFAULT_SECURITY_DAC
• default "landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf"

• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,bpf" if DEFAULT_SECURITY_DAC
• default "digest_cache,landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf" help A comma-separated list of LSMs, in initialization order. Any LSMs left off this list, except for those with order

diff --git a/security/Makefile b/security/Makefile index 59f238490665..e9b43e7b715a 100644 --- a/security/Makefile +++ b/security/Makefile @@ -25,6 +25,7 @@ obj-$(CONFIG_SECURITY_LOCKDOWN_LSM) += lockdown/ obj-$(CONFIG_CGROUPS) += device_cgroup.o obj-$(CONFIG_BPF_LSM) += bpf/ obj-$(CONFIG_SECURITY_LANDLOCK) += landlock/ +obj-$(CONFIG_SECURITY_DIGEST_CACHE) += digest_cache/ # Object integrity file lists obj-$(CONFIG_INTEGRITY) += integrity/ diff --git a/security/digest_cache/Kconfig b/security/digest_cache/Kconfig new file mode 100644 index 000000000000..e53fbf0779d6 --- /dev/null +++ b/security/digest_cache/Kconfig @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: GPL-2.0 +config SECURITY_DIGEST_CACHE

• bool "Digest_cache LSM"
• default n
• help

•  This option enables an LSM maintaining a cache of digests
  

•  (e.g. of file data or metadata).
  

•  This LSM can support other kernel components in making access
  

•  control decisions.
  

+config DIGEST_LIST_DEFAULT_PATH

• string
• default "/etc/digest_lists"
• help

•  Default directory where digest_cache LSM expects to find digest lists.
  

diff --git a/security/digest_cache/Makefile b/security/digest_cache/Makefile new file mode 100644 index 000000000000..48848c41253e --- /dev/null +++ b/security/digest_cache/Makefile @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Makefile for building the digest_cache LSM.

+obj-$(CONFIG_SECURITY_DIGEST_CACHE) += digest_cache.o

+digest_cache-y := main.o diff --git a/security/digest_cache/internal.h b/security/digest_cache/internal.h new file mode 100644 index 000000000000..5f04844af3a5 --- /dev/null +++ b/security/digest_cache/internal.h @@ -0,0 +1,86 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com

ditto

...

• • Internal header of the digest_cache LSM.
• */

+#ifndef _DIGEST_CACHE_INTERNAL_H +#define _DIGEST_CACHE_INTERNAL_H

+#include <linux/lsm_hooks.h> +#include <linux/digest_cache.h>

+/* Digest cache bits in flags. */ +#define INIT_IN_PROGRESS 0 /* Digest cache being initialized. */

+/**

• • struct digest_cache - Digest cache
• • @ref_count: Number of references to the digest cache
• • @path_str: Path of the digest list the digest cache was created from
• • @flags: Control flags
• • This structure represents a cache of digests extracted from a digest list.
• */

+struct digest_cache {

• atomic_t ref_count;
• char *path_str;
• unsigned long flags;

+};

+/**

• • struct digest_cache_security - Digest cache pointers in inode security blob
• • @dig_owner: Digest cache created from this inode
• • @dig_owner_mutex: Protects @dig_owner
• • @dig_user: Digest cache requested for this inode
• • @dig_user_mutex: Protects @dig_user
• • This structure contains references to digest caches, protected by their
• • respective mutex.
• */

+struct digest_cache_security {

• struct digest_cache *dig_owner;
• struct mutex dig_owner_mutex;
• struct digest_cache *dig_user;
• struct mutex dig_user_mutex;

+};

+extern struct lsm_blob_sizes digest_cache_blob_sizes; +extern char *default_path_str;

+static inline struct digest_cache_security * +digest_cache_get_security(const struct inode *inode) +{

• if (unlikely(!inode->i_security))

• return NULL;
  

• return inode->i_security + digest_cache_blob_sizes.lbs_inode;

+}

+static inline struct digest_cache * +digest_cache_ref(struct digest_cache *digest_cache) +{

• atomic_inc(&digest_cache->ref_count);
• pr_debug("Ref (+) digest cache %s (ref count: %d)\n",

•  digest_cache->path_str, atomic_read(&digest_cache->ref_count));
  

• return digest_cache;

+}

+static inline struct digest_cache * +digest_cache_unref(struct digest_cache *digest_cache) +{

• bool ref_is_zero = atomic_dec_and_test(&digest_cache->ref_count);
• pr_debug("Ref (-) digest cache %s (ref count: %d)\n",

•  digest_cache->path_str, atomic_read(&digest_cache->ref_count));
  

• return (ref_is_zero) ? digest_cache : NULL;

+}

+/* main.c */ +struct digest_cache *digest_cache_create(struct dentry *dentry,

• 			 struct path *digest_list_path,
  

• 			 char *path_str, char *filename);
  

+#endif /* _DIGEST_CACHE_INTERNAL_H */ diff --git a/security/digest_cache/main.c b/security/digest_cache/main.c new file mode 100644 index 000000000000..14dba8915e99 --- /dev/null +++ b/security/digest_cache/main.c @@ -0,0 +1,404 @@ +// SPDX-License-Identifier: GPL-2.0 +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com
• • Implement the main code of the digest_cache LSM.
• */

+#define pr_fmt(fmt) "DIGEST CACHE: "fmt +#include <linux/namei.h> +#include <linux/xattr.h>

+#include "internal.h"

+static int digest_cache_enabled __ro_after_init = 1; +static struct kmem_cache *digest_cache_cache __read_mostly;

+char *default_path_str = CONFIG_DIGEST_LIST_DEFAULT_PATH;

+/**

• • digest_cache_alloc_init - Allocate and initialize a new digest cache
• • @path_str: Path string of the digest list
• • @filename: Digest list file name (can be an empty string)
• • This function allocates and initializes a new digest cache.
• • Return: A digest_cache structure on success, NULL on error.
• */

+static struct digest_cache *digest_cache_alloc_init(char *path_str,

• 				    char *filename)
  

+{

• struct digest_cache *digest_cache;
• digest_cache = kmem_cache_alloc(digest_cache_cache, GFP_KERNEL);
• if (!digest_cache)

• return digest_cache;
  

• digest_cache->path_str = kasprintf(GFP_KERNEL, "%s%s%s", path_str,

• 			   filename[0] ? "/" : "", filename);
  

• if (!digest_cache->path_str) {

• kmem_cache_free(digest_cache_cache, digest_cache);
  

• return NULL;
  

• }
• atomic_set(&digest_cache->ref_count, 1);
• digest_cache->flags = 0UL;
• pr_debug("New digest cache %s (ref count: %d)\n",

•  digest_cache->path_str, atomic_read(&digest_cache->ref_count));
  

Nit: kretprobe can be used to grab the same information easil and do e.g. statistics and stuff like that. Traces for return values are not very useful.

I like to do dynamic debug, and I can control what part I want to debug. All these messages allowed me to debug efficiently when there was any issue. Would be a pity to remove them.

OK, in this case I missed the fact that the function is static so you can ignore it!

Thanks

Roberto

...

...

• return digest_cache;

+}

+/**

• • digest_cache_free - Free all memory occupied by the digest cache
• • @digest_cache: Digest cache
• • This function frees the memory occupied by the digest cache.
• */

+static void digest_cache_free(struct digest_cache *digest_cache) +{

• pr_debug("Freed digest cache %s\n", digest_cache->path_str);

ditto for the above trace

...

• kfree(digest_cache->path_str);
• kmem_cache_free(digest_cache_cache, digest_cache);

+}

+/**

• • digest_cache_create - Create a digest cache
• • @dentry: Dentry of the inode for which the digest cache will be used
• • @digest_list_path: Path structure of the digest list
• • @path_str: Path string of the digest list
• • @filename: Digest list file name (can be an empty string)
• • This function first locates, from the passed path, the digest list inode
• • from which the digest cache will be created or retrieved (if it already
• • exists).
• • If dig_owner is NULL in the inode security blob, this function creates a
• • new digest cache with reference count set to 1 (reference returned), sets
• • it to dig_owner and consequently increments again the digest cache reference
• • count.
• • Otherwise, it simply increments the reference count of the existing
• • dig_owner, since that reference is returned to the caller.
• • Incrementing the reference count twice before calling path_put() ensures
• • that the digest cache returned is valid even if the inode is evicted from
• • memory (which decreases the reference count).
• • Releasing the dig_owner_mutex lock does not mean that the digest cache is
• • ready for use. digest_cache_create() callers that found a partially
• • instantiated digest cache have to wait until the INIT_IN_PROGRESS bit is
• • cleared by the caller that is actually creating that digest cache.
• • Return: A new digest cache on success, NULL on error.
• */

+struct digest_cache *digest_cache_create(struct dentry *dentry,

• 			 struct path *digest_list_path,
  

• 			 char *path_str, char *filename)
  

+{

• struct path file_path;
• struct digest_cache *digest_cache = NULL;
• struct digest_cache_security *dig_sec;
• struct inode *inode = d_backing_inode(digest_list_path->dentry);
• bool dig_owner_exists = false;
• int ret;
• if (S_ISDIR(d_backing_inode(digest_list_path->dentry)->i_mode) &&

•    filename[0]) {
  

• ret = vfs_path_lookup(digest_list_path->dentry,
  

• 		      digest_list_path->mnt, filename, 0,
  

• 		      &file_path);
  

• if (ret < 0) {
  

• 	pr_debug("Cannot find digest list %s/%s\n", path_str,
  

• 		 filename);
  

• 	return NULL;
  

• }
  

• digest_list_path = &file_path;
  

• inode = d_backing_inode(file_path.dentry);
  

• /*
  

•  * Cannot request a digest cache for the same inode the
  

•  * digest cache is populated from.
  

•  */
  

• if (d_backing_inode(dentry) == inode) {
  

• 	pr_debug("Cannot request a digest cache for %s and use it as digest list\n",
  

• 		 dentry->d_name.name);
  

• 	goto out;
  

• }
  

• /* No support for nested directories. */
  

• if (!S_ISREG(inode->i_mode)) {
  

• 	pr_debug("%s is not a regular file (no support for nested directories)\n",
  

• 		 dentry->d_name.name);
  

• 	goto out;
  

• }
  

• }
• dig_sec = digest_cache_get_security(inode);
• if (unlikely(!dig_sec))

• goto out;
  

• /* Serialize check and assignment of dig_owner. */
• mutex_lock(&dig_sec->dig_owner_mutex);
• if (dig_sec->dig_owner) {

• /* Increment ref. count for reference returned to the caller. */
  

• digest_cache = digest_cache_ref(dig_sec->dig_owner);
  

• dig_owner_exists = true;
  

• mutex_unlock(&dig_sec->dig_owner_mutex);
  

• goto exists;
  

• }
• /* Ref. count is already 1 for this reference. */
• digest_cache = digest_cache_alloc_init(path_str, filename);
• if (!digest_cache) {

• mutex_unlock(&dig_sec->dig_owner_mutex);
  

• goto out;
  

• }
• /* Increment ref. count for reference set to dig_owner. */
• dig_sec->dig_owner = digest_cache_ref(digest_cache);
• /* Make the other lock contenders wait until creation complete. */
• set_bit(INIT_IN_PROGRESS, &dig_sec->dig_owner->flags);
• mutex_unlock(&dig_sec->dig_owner_mutex);
• /* Creation complete, notify the other lock contenders. */
• clear_and_wake_up_bit(INIT_IN_PROGRESS, &dig_sec->dig_owner->flags);

+exists:

• if (dig_owner_exists)

• /* Wait until creation complete. */
  

• wait_on_bit(&dig_sec->dig_owner->flags, INIT_IN_PROGRESS,
  

• 	    TASK_UNINTERRUPTIBLE);
  

+out:

• if (digest_list_path == &file_path)

• path_put(&file_path);
  

• return digest_cache;

+}

+/**

• • digest_cache_new - Retrieve digest list file name and request digest cache
• • @dentry: Dentry of the inode for which the digest cache will be used
• • This function locates the default path. If it is a file, it directly creates
• • a digest cache from it. Otherwise, it reads the digest list file name from
• • the security.digest_list xattr and requests the creation of a digest cache
• • with that file name. If security.digest_list is not found, this function
• • requests the creation of a digest cache on the parent directory.
• • Return: A new digest cache on success, NULL on error.
• */

+static struct digest_cache *digest_cache_new(struct dentry *dentry) +{

• char filename[NAME_MAX + 1] = { 0 };
• struct digest_cache *digest_cache = NULL;
• struct path default_path;
• int ret;
• ret = kern_path(default_path_str, 0, &default_path);
• if (ret < 0) {

• pr_debug("Cannot find path %s\n", default_path_str);
  

• return NULL;
  

• }
• /* The default path is a file, no need to get xattr. */
• if (S_ISREG(d_backing_inode(default_path.dentry)->i_mode)) {

• pr_debug("Default path %s is a file, not reading %s xattr\n",
  

• 	 default_path_str, XATTR_NAME_DIGEST_LIST);
  

• goto create;
  

• } else if (!S_ISDIR(d_backing_inode(default_path.dentry)->i_mode)) {

• pr_debug("Default path %s must be either a file or a directory\n",
  

• 	 default_path_str);
  

• goto out;
  

• }
• ret = vfs_getxattr(&nop_mnt_idmap, dentry, XATTR_NAME_DIGEST_LIST,

• 	   filename, sizeof(filename) - 1);
  

• if (ret <= 0) {

• pr_debug("Digest list path not found for file %s, using %s\n",
  

• 	 dentry->d_name.name, default_path_str);
  

• goto create;
  

• }
• if (strchr(filename, '/')) {

• pr_debug("%s xattr should contain only a file name, got: %s\n",
  

• 	 XATTR_NAME_DIGEST_LIST, filename);
  

• goto out;
  

• }
• pr_debug("Found %s xattr in %s, default path: %s, digest list: %s\n",

•  XATTR_NAME_DIGEST_LIST, dentry->d_name.name, default_path_str,
  

•  filename);
  

+create:

• digest_cache = digest_cache_create(dentry, &default_path,

• 			   default_path_str, filename);
  

+out:

• path_put(&default_path);
• return digest_cache;

+}

+/**

• • digest_cache_get - Get a digest cache for a given inode
• • @dentry: Dentry of the inode for which the digest cache will be used
• • This function tries to find a digest cache from the inode security blob of
• • the passed dentry (dig_user field). If a digest cache was not found, it calls
• • digest_cache_new() to create a new one. In both cases, it increments the
• • digest cache reference count before returning the reference to the caller.
• • The caller is responsible to call digest_cache_put() to release the digest
• • cache reference returned.
• • Lock dig_user_mutex to protect against concurrent requests to obtain a digest
• • cache for the same inode, and to make other contenders wait until the first
• • requester finishes the process.
• • Return: A digest cache on success, NULL otherwise.
• */

+struct digest_cache *digest_cache_get(struct dentry *dentry) +{

• struct digest_cache_security *dig_sec;
• struct digest_cache *digest_cache = NULL;
• struct inode *inode = d_backing_inode(dentry);
• if (!digest_cache_enabled)

• return NULL;
  

• dig_sec = digest_cache_get_security(inode);
• if (unlikely(!dig_sec))

• return NULL;
  

• /* Serialize accesses to inode for which the digest cache is used. */
• mutex_lock(&dig_sec->dig_user_mutex);
• if (!dig_sec->dig_user)

• /* Consume extra reference from digest_cache_create(). */
  

• dig_sec->dig_user = digest_cache_new(dentry);
  

• if (dig_sec->dig_user)

• /* Increment ref. count for reference returned to the caller. */
  

• digest_cache = digest_cache_ref(dig_sec->dig_user);
  

• mutex_unlock(&dig_sec->dig_user_mutex);
• return digest_cache;

+} +EXPORT_SYMBOL_GPL(digest_cache_get);

+/**

• • digest_cache_put - Release a digest cache reference
• • @digest_cache: Digest cache
• • This function decrements the reference count of the digest cache passed as
• • argument. If the reference count reaches zero, it calls digest_cache_free()
• • to free the digest cache.
• */

+void digest_cache_put(struct digest_cache *digest_cache) +{

• struct digest_cache *to_free;
• to_free = digest_cache_unref(digest_cache);
• if (!to_free)

• return;
  

• digest_cache_free(to_free);

+} +EXPORT_SYMBOL_GPL(digest_cache_put);

+struct lsm_blob_sizes digest_cache_blob_sizes __ro_after_init = {

• .lbs_inode = sizeof(struct digest_cache_security),

+};

+/**

• • digest_cache_inode_alloc_security - Initialize inode security blob
• • @inode: Inode for which the security blob is initialized
• • This function initializes the digest_cache_security structure, directly
• • stored in the inode security blob.
• • Return: Zero.
• */

+static int digest_cache_inode_alloc_security(struct inode *inode) +{

• struct digest_cache_security *dig_sec;
• /* The inode security blob is always allocated here. */
• dig_sec = digest_cache_get_security(inode);
• mutex_init(&dig_sec->dig_owner_mutex);
• mutex_init(&dig_sec->dig_user_mutex);
• return 0;

+}

+/**

• • digest_cache_inode_free_security - Release the digest cache references
• • @inode: Inode for which the digest cache references are released
• • Since the inode is being evicted, this function releases the non-needed
• • references to the digest caches stored in the digest_cache_security
• • structure.
• */

+static void digest_cache_inode_free_security(struct inode *inode) +{

• struct digest_cache_security *dig_sec;
• dig_sec = digest_cache_get_security(inode);
• if (!dig_sec)

• return;
  

• mutex_destroy(&dig_sec->dig_owner_mutex);
• mutex_destroy(&dig_sec->dig_user_mutex);
• if (dig_sec->dig_owner)

• digest_cache_put(dig_sec->dig_owner);
  

• if (dig_sec->dig_user)

• digest_cache_put(dig_sec->dig_user);
  

+}

+static struct security_hook_list digest_cache_hooks[] __ro_after_init = {

• LSM_HOOK_INIT(inode_alloc_security, digest_cache_inode_alloc_security),
• LSM_HOOK_INIT(inode_free_security, digest_cache_inode_free_security),

+};

+/**

• • digest_cache_init_once - Initialize the digest cache structure
• • @foo: Digest cache structure to initialize
• • This function fills the digest cache structure with zeros.
• */

+static void digest_cache_init_once(void *foo) +{

• struct digest_cache *digest_cache = (struct digest_cache *)foo;
• memset(digest_cache, 0, sizeof(*digest_cache));

+}

+static const struct lsm_id digest_cache_lsmid = {

• .name = "digest_cache",
• .id = LSM_ID_DIGEST_CACHE,

+};

+/**

• • digest_cache_init - Initialize the digest_cache LSM
• • Initialize the digest_cache LSM, by instantiating a cache for the
• • digest_cache structure and by registering the digest_cache LSM hooks.
• */

+static int __init digest_cache_init(void) +{

• digest_cache_cache = kmem_cache_create("digest_cache_cache",

• 			       sizeof(struct digest_cache),
  

• 			       0, SLAB_PANIC,
  

• 			       digest_cache_init_once);
  

• security_add_hooks(digest_cache_hooks, ARRAY_SIZE(digest_cache_hooks),

• 	   &digest_cache_lsmid);
  

• return 0;

+}

+DEFINE_LSM(digest_cache) = {

• .name = "digest_cache",
• .enabled = &digest_cache_enabled,
• .init = digest_cache_init,
• .blobs = &digest_cache_blob_sizes,

+}; diff --git a/security/security.c b/security/security.c index cbdc9bebe802..cb084ed58617 100644 --- a/security/security.c +++ b/security/security.c @@ -50,7 +50,8 @@ (IS_ENABLED(CONFIG_BPF_LSM) ? 1 : 0) + \ (IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0) + \ (IS_ENABLED(CONFIG_IMA) ? 1 : 0) + \

• (IS_ENABLED(CONFIG_EVM) ? 1 : 0))

• (IS_ENABLED(CONFIG_EVM) ? 1 : 0) + \
• (IS_ENABLED(CONFIG_SECURITY_DIGEST_CACHE) ? 1 : 0))

/*

• These are descriptions of the reasons that can be passed to the

diff --git a/tools/testing/selftests/lsm/lsm_list_modules_test.c b/tools/testing/selftests/lsm/lsm_list_modules_test.c index 4d5d4cee2586..d00831edc582 100644 --- a/tools/testing/selftests/lsm/lsm_list_modules_test.c +++ b/tools/testing/selftests/lsm/lsm_list_modules_test.c @@ -128,6 +128,9 @@ TEST(correct_lsm_list_modules) case LSM_ID_EVM: name = "evm"; break;

• case LSM_ID_DIGEST_CACHE:
  

• 	name = "digest_cache";
  

• 	break;
  

  default: name = "INVALID"; break;

BR, Jarkko

BR, Jarkko

On 4/15/2024 9:32 PM, Jarkko Sakkinen wrote:

On Mon Apr 15, 2024 at 5:24 PM EEST, Roberto Sassu wrote:

...

From: Roberto Sassu roberto.sassu@huawei.com

Add the digest_cache_path file in securityfs, to let root change/read the default path (file or directory) from where digest lists are looked up.

An RW semaphore prevents the default path from changing while digest_list_new() and read_default_path() are executed, so that those read a stable value. Multiple digest_list_new() and read_default_path() calls, instead, can be done in parallel, since they are the readers.

Changing the default path does not affect digest caches created with the old path.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com

security/digest_cache/Kconfig | 4 ++ security/digest_cache/Makefile | 2 +- security/digest_cache/internal.h | 1 + security/digest_cache/main.c | 10 +++- security/digest_cache/secfs.c | 87 ++++++++++++++++++++++++++++++++ 5 files changed, 102 insertions(+), 2 deletions(-) create mode 100644 security/digest_cache/secfs.c

diff --git a/security/digest_cache/Kconfig b/security/digest_cache/Kconfig index e53fbf0779d6..dfabe5d6e3ca 100644 --- a/security/digest_cache/Kconfig +++ b/security/digest_cache/Kconfig @@ -14,3 +14,7 @@ config DIGEST_LIST_DEFAULT_PATH default "/etc/digest_lists" help Default directory where digest_cache LSM expects to find digest lists.

•  It can be changed at run-time, by writing the new path to the
  

•  securityfs interface. Digest caches created with the old path are
  

•  not affected by the change.
  

diff --git a/security/digest_cache/Makefile b/security/digest_cache/Makefile index 48848c41253e..1330655e33b1 100644 --- a/security/digest_cache/Makefile +++ b/security/digest_cache/Makefile @@ -4,4 +4,4 @@ obj-$(CONFIG_SECURITY_DIGEST_CACHE) += digest_cache.o -digest_cache-y := main.o +digest_cache-y := main.o secfs.o diff --git a/security/digest_cache/internal.h b/security/digest_cache/internal.h index 5f04844af3a5..bbf5eefe5c82 100644 --- a/security/digest_cache/internal.h +++ b/security/digest_cache/internal.h @@ -49,6 +49,7 @@ struct digest_cache_security { extern struct lsm_blob_sizes digest_cache_blob_sizes; extern char *default_path_str; +extern struct rw_semaphore default_path_sem; static inline struct digest_cache_security * digest_cache_get_security(const struct inode *inode) diff --git a/security/digest_cache/main.c b/security/digest_cache/main.c index 14dba8915e99..661c8d106791 100644 --- a/security/digest_cache/main.c +++ b/security/digest_cache/main.c @@ -18,6 +18,9 @@ static struct kmem_cache *digest_cache_cache __read_mostly; char *default_path_str = CONFIG_DIGEST_LIST_DEFAULT_PATH; +/* Protects default_path_str. */ +struct rw_semaphore default_path_sem;

• /**
  • digest_cache_alloc_init - Allocate and initialize a new digest cache
  • @path_str: Path string of the digest list

@@ -274,9 +277,12 @@ struct digest_cache *digest_cache_get(struct dentry *dentry) /* Serialize accesses to inode for which the digest cache is used. */ mutex_lock(&dig_sec->dig_user_mutex);

• if (!dig_sec->dig_user)

• if (!dig_sec->dig_user) {

• down_read(&default_path_sem);
  

  /* Consume extra reference from digest_cache_create(). */ dig_sec->dig_user = digest_cache_new(dentry);

• up_read(&default_path_sem);
  

• }

if (dig_sec->dig_user) /* Increment ref. count for reference returned to the caller. */ @@ -386,6 +392,8 @@ static const struct lsm_id digest_cache_lsmid = { */ static int __init digest_cache_init(void) {

• init_rwsem(&default_path_sem);
• digest_cache_cache = kmem_cache_create("digest_cache_cache", sizeof(struct digest_cache), 0, SLAB_PANIC,

diff --git a/security/digest_cache/secfs.c b/security/digest_cache/secfs.c new file mode 100644 index 000000000000..d3a37bf3588e --- /dev/null +++ b/security/digest_cache/secfs.c @@ -0,0 +1,87 @@ +// SPDX-License-Identifier: GPL-2.0 +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com
• • Implement the securityfs interface of the digest_cache LSM.
• */

+#define pr_fmt(fmt) "DIGEST CACHE: "fmt +#include <linux/security.h>

+#include "internal.h"

+static struct dentry *default_path_dentry;

+/**

• • write_default_path - Write default path
• • @file: File descriptor of the securityfs file
• • @buf: User space buffer
• • @datalen: Amount of data to write
• • @ppos: Current position in the file
• • This function sets the new default path where digest lists can be found.
• • Can be either a regular file or a directory.
• • Return: Length of path written on success, a POSIX error code otherwise.
• */

+static ssize_t write_default_path(struct file *file, const char __user *buf,

• 		  size_t datalen, loff_t *ppos)
  

+{

• char *new_default_path_str;
• new_default_path_str = memdup_user_nul(buf, datalen);
• if (IS_ERR(new_default_path_str))

• return PTR_ERR(new_default_path_str);
  

• down_write(&default_path_sem);
• kfree_const(default_path_str);
• default_path_str = new_default_path_str;
• up_write(&default_path_sem);
• return datalen;

+}

+/**

• • read_default_path - Read default path
• • @file: File descriptor of the securityfs file
• • @buf: User space buffer
• • @datalen: Amount of data to read
• • @ppos: Current position in the file
• • This function returns the current default path where digest lists can be
• • found. Can be either a regular file or a directory.
• • Return: Length of path read on success, a POSIX error code otherwise.
• */

+static ssize_t read_default_path(struct file *file, char __user *buf,

• 		 size_t datalen, loff_t *ppos)
  

+{

• int ret;
• down_read(&default_path_sem);
• ret = simple_read_from_buffer(buf, datalen, ppos, default_path_str,

• 		      strlen(default_path_str) + 1);
  

• up_read(&default_path_sem);
• return ret;

+}

+static const struct file_operations default_path_ops = {

• .open = generic_file_open,
• .write = write_default_path,
• .read = read_default_path,
• .llseek = generic_file_llseek,

+};

+static int __init digest_cache_path_init(void) +{

• default_path_dentry = securityfs_create_file("digest_cache_path", 0660,

• 				     NULL, NULL,
  

• 				     &default_path_ops);
  

• if (IS_ERR(default_path_dentry))

• return -EFAULT;
  

Nit: when overwriting error value with another error value it would be best to document it with an inline comment. Otherwise, it is fine.

Seems to make sense to return the right error. Will check why this one (I probably took from somewhere).

Thanks

Roberto

...

• return 0;

+}

+late_initcall(digest_cache_path_init);

BR, Jarkko

On 4/15/2024 9:36 PM, Jarkko Sakkinen wrote:

On Mon Apr 15, 2024 at 5:24 PM EEST, Roberto Sassu wrote:

...

From: Roberto Sassu roberto.sassu@huawei.com

Add a linked list of hash tables to the digest cache, one per algorithm, containing the digests extracted from digest lists.

The number of hash table slots is determined by dividing the number of digests to add to the average depth of the collision list defined with CONFIG_DIGEST_CACHE_HTABLE_DEPTH (currently set to 30). It can be changed in the kernel configuration.

Add digest_cache_htable_init() and digest_cache_htable_add(), to be called by digest list parsers, in order to allocate the hash tables and to add extracted digests.

Add digest_cache_htable_free(), to let the digest_cache LSM free the hash tables at the time a digest cache is freed.

Add digest_cache_htable_lookup() to search a digest in the hash table of a digest cache for a given algorithm.

Add digest_cache_lookup() to the public API, to let users of the digest_cache LSM search a digest in a digest cache and, in a subsequent patch, to search it in the digest caches for each directory entry.

Return the digest cache containing the digest, as a different type, digest_cache_found_t to avoid it being accidentally put. Also, introduce digest_cache_from_found_t() to explicitly convert it back to a digest cache for further use (e.g. retrieving verification data, introduced later).

Finally, add digest_cache_hash_key() to compute the hash table key from the first two bytes of the digest (modulo the number of slots).

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com

include/linux/digest_cache.h | 34 +++++ security/digest_cache/Kconfig | 11 ++ security/digest_cache/Makefile | 2 +- security/digest_cache/htable.c | 250 +++++++++++++++++++++++++++++++ security/digest_cache/internal.h | 43 ++++++ security/digest_cache/main.c | 3 + 6 files changed, 342 insertions(+), 1 deletion(-) create mode 100644 security/digest_cache/htable.c

diff --git a/include/linux/digest_cache.h b/include/linux/digest_cache.h index e79f94a60b0f..4872700ac205 100644 --- a/include/linux/digest_cache.h +++ b/include/linux/digest_cache.h @@ -11,12 +11,39 @@ #define _LINUX_DIGEST_CACHE_H #include <linux/fs.h> +#include <crypto/hash_info.h> struct digest_cache; +/**

• • typedef digest_cache_found_t - Digest cache reference as numeric value
• • This new type represents a digest cache reference that should not be put.
• */

+typedef unsigned long digest_cache_found_t;

+/**

• • digest_cache_from_found_t - Convert digest_cache_found_t to digest cache ptr
• • @found: digest_cache_found_t value
• • Convert the digest_cache_found_t returned by digest_cache_lookup() to a
• • digest cache pointer, so that it can be passed to the other functions of the
• • API.
• • Return: Digest cache pointer.
• */

+static inline struct digest_cache * +digest_cache_from_found_t(digest_cache_found_t found) +{

• return (struct digest_cache *)found;

+}

• #ifdef CONFIG_SECURITY_DIGEST_CACHE struct digest_cache *digest_cache_get(struct dentry *dentry); void digest_cache_put(struct digest_cache *digest_cache);

+digest_cache_found_t digest_cache_lookup(struct dentry *dentry,

• 			 struct digest_cache *digest_cache,
  

• 			 u8 *digest, enum hash_algo algo);
  

#else static inline struct digest_cache *digest_cache_get(struct dentry *dentry) @@ -28,5 +55,12 @@ static inline void digest_cache_put(struct digest_cache *digest_cache) { } +static inline digest_cache_found_t +digest_cache_lookup(struct dentry *dentry, struct digest_cache *digest_cache,

•     u8 *digest, enum hash_algo algo)
  

+{

• return 0UL;

+}

• #endif /* CONFIG_SECURITY_DIGEST_CACHE */ #endif /* _LINUX_DIGEST_CACHE_H */

diff --git a/security/digest_cache/Kconfig b/security/digest_cache/Kconfig index dfabe5d6e3ca..71017954e5c5 100644 --- a/security/digest_cache/Kconfig +++ b/security/digest_cache/Kconfig @@ -18,3 +18,14 @@ config DIGEST_LIST_DEFAULT_PATH It can be changed at run-time, by writing the new path to the securityfs interface. Digest caches created with the old path are not affected by the change.

+config DIGEST_CACHE_HTABLE_DEPTH

• int
• default 30
• help

•  Desired average depth of the collision list in the digest cache
  

•  hash tables.
  

•  A smaller number will increase the amount of hash table slots, and
  

•  make the search faster. A bigger number will decrease the number of
  

•  hash table slots, but make the search slower.
  

diff --git a/security/digest_cache/Makefile b/security/digest_cache/Makefile index 1330655e33b1..7e00c53d8f55 100644 --- a/security/digest_cache/Makefile +++ b/security/digest_cache/Makefile @@ -4,4 +4,4 @@ obj-$(CONFIG_SECURITY_DIGEST_CACHE) += digest_cache.o -digest_cache-y := main.o secfs.o +digest_cache-y := main.o secfs.o htable.o diff --git a/security/digest_cache/htable.c b/security/digest_cache/htable.c new file mode 100644 index 000000000000..d2d5d8f5e5b1 --- /dev/null +++ b/security/digest_cache/htable.c @@ -0,0 +1,250 @@ +// SPDX-License-Identifier: GPL-2.0 +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com
• • Implement hash table operations for the digest cache.
• */

+#define pr_fmt(fmt) "DIGEST CACHE: "fmt

For easier grepping from kernel tree i'd suggest to name this accordingly i.e. just "digest_cache".

Ok, no problem.

...

+#include "internal.h"

+/**

• • digest_cache_hash_key - Compute hash key
• • @digest: Digest cache
• • @num_slots: Number of slots in the hash table
• • This function computes a hash key based on the first two bytes of the
• • digest and the number of slots of the hash table.
• • Return: Hash key.
• */

+static inline unsigned int digest_cache_hash_key(u8 *digest,

• 				 unsigned int num_slots)
  

+{

• /* Same as ima_hash_key() but parametrized. */
• return (digest[0] | digest[1] << 8) % num_slots;

+}

+/**

• • lookup_htable - Lookup a hash table
• • @digest_cache: Digest cache
• • @algo: Algorithm of the desired hash table
• • This function searches the hash table for a given algorithm in the digest
• • cache.
• • Return: A hash table if found, NULL otherwise.
• */

+static struct htable *lookup_htable(struct digest_cache *digest_cache,

• 		    enum hash_algo algo)
  

+{

• struct htable *h;
• list_for_each_entry(h, &digest_cache->htables, next)

• if (h->algo == algo)
  

• 	return h;
  

• return NULL;

+}

+/**

• • digest_cache_htable_init - Allocate and initialize the hash table
• • @digest_cache: Digest cache
• • @num_digests: Number of digests to add to the digest cache
• • @algo: Algorithm of the digests
• • This function allocates and initializes the hash table for a given algorithm.
• • The number of slots depends on the number of digests to add to the digest
• • cache, and the constant CONFIG_DIGEST_CACHE_HTABLE_DEPTH stating the desired
• • average depth of the collision list.
• • Return: Zero on success, a POSIX error code otherwise.
• */

+int digest_cache_htable_init(struct digest_cache *digest_cache, u64 num_digests,

• 	     enum hash_algo algo)
  

+{

• struct htable *h;
• int i;
• h = lookup_htable(digest_cache, algo);
• if (h)

• return 0;
  

• h = kmalloc(sizeof(*h), GFP_KERNEL);
• if (!h)

• return -ENOMEM;
  

• h->num_slots = DIV_ROUND_UP(num_digests,

• 		    CONFIG_DIGEST_CACHE_HTABLE_DEPTH);
  

• h->slots = kmalloc_array(h->num_slots, sizeof(*h->slots), GFP_KERNEL);
• if (!h->slots) {

• kfree(h);
  

• return -ENOMEM;
  

• }
• for (i = 0; i < h->num_slots; i++)

• INIT_HLIST_HEAD(&h->slots[i]);
  

• h->num_digests = 0;
• h->algo = algo;
• list_add_tail(&h->next, &digest_cache->htables);
• pr_debug("Initialized hash table for digest list %s, digests: %llu, slots: %u, algo: %s\n",

•  digest_cache->path_str, num_digests, h->num_slots,
  

•  hash_algo_name[algo]);
  

• return 0;

+}

+/**

• • digest_cache_htable_add - Add a new digest to the digest cache
• • @digest_cache: Digest cache
• • @digest: Digest to add
• • @algo: Algorithm of digest
• • This function, invoked by a digest list parser, adds a digest extracted
• • from a digest list to the digest cache.
• • Return: Zero on success, a POSIX error code otherwise.
• */

+int digest_cache_htable_add(struct digest_cache *digest_cache, u8 *digest,

• 	    enum hash_algo algo)
  

+{

• struct htable *h;
• struct digest_cache_entry *entry;
• unsigned int key;
• int digest_len;
• h = lookup_htable(digest_cache, algo);
• if (!h) {

• pr_debug("No hash table for algorithm %s was found in digest cache %s, initialize one\n",
  

• 	 hash_algo_name[algo], digest_cache->path_str);
  

• return -ENOENT;
  

• }
• digest_len = hash_digest_size[algo];
• entry = kmalloc(sizeof(*entry) + digest_len, GFP_KERNEL);
• if (!entry)

• return -ENOMEM;
  

• memcpy(entry->digest, digest, digest_len);
• key = digest_cache_hash_key(digest, h->num_slots);
• hlist_add_head(&entry->hnext, &h->slots[key]);
• h->num_digests++;
• pr_debug("Added digest %s:%*phN to digest cache %s, num of %s digests: %llu\n",

•  hash_algo_name[algo], digest_len, digest,
  

•  digest_cache->path_str, hash_algo_name[algo], h->num_digests);
  

• return 0;

+}

+/**

• • digest_cache_htable_lookup - Search a digest in the digest cache
• • @dentry: Dentry of the file whose digest is looked up
• • @digest_cache: Digest cache
• • @digest: Digest to search
• • @algo: Algorithm of the digest to search
• • This function searches the passed digest and algorithm in the passed digest
• • cache.
• • Return: Zero if the digest is found, -ENOENT if not.
• */

+int digest_cache_htable_lookup(struct dentry *dentry,

• 	       struct digest_cache *digest_cache, u8 *digest,
  

• 	       enum hash_algo algo)
  

+{

• struct digest_cache_entry *entry;
• struct htable *h;
• unsigned int key;
• int digest_len;
• int search_depth = 0;
• h = lookup_htable(digest_cache, algo);
• if (!h)

• return -ENOENT;
  

• digest_len = hash_digest_size[algo];
• key = digest_cache_hash_key(digest, h->num_slots);
• hlist_for_each_entry(entry, &h->slots[key], hnext) {

• if (!memcmp(entry->digest, digest, digest_len)) {
  

• 	pr_debug("Cache hit at depth %d for file %s, digest %s:%*phN in digest cache %s\n",
  

• 		 search_depth, dentry->d_name.name,
  

• 		 hash_algo_name[algo], digest_len, digest,
  

• 		 digest_cache->path_str);
  

• 	return 0;
  

• }
  

• search_depth++;
  

• }
• pr_debug("Cache miss for file %s, digest %s:%*phN in digest cache %s\n",

•  dentry->d_name.name, hash_algo_name[algo], digest_len, digest,
  

•  digest_cache->path_str);
  

• return -ENOENT;

+}

+/**

• • digest_cache_lookup - Search a digest in the digest cache
• • @dentry: Dentry of the file whose digest is looked up
• • @digest_cache: Digest cache
• • @digest: Digest to search
• • @algo: Algorithm of the digest to search
• • This function calls digest_cache_htable_lookup() to search a digest in the
• • passed digest cache, obtained with digest_cache_get().
• • It returns the digest cache reference as the digest_cache_found_t type, to
• • avoid that the digest cache is accidentally put. The digest_cache_found_t
• • type can be converted back to a digest cache pointer, by
• • calling digest_cache_from_found_t().
• • Return: A positive digest_cache_found_t if the digest is found, zero if not.
• */

+digest_cache_found_t digest_cache_lookup(struct dentry *dentry,

• 			 struct digest_cache *digest_cache,
  

• 			 u8 *digest, enum hash_algo algo)
  

+{

• int ret;
• ret = digest_cache_htable_lookup(dentry, digest_cache, digest, algo);
• return (!ret) ? (digest_cache_found_t)digest_cache : 0UL;

+} +EXPORT_SYMBOL_GPL(digest_cache_lookup);

+/**

• • digest_cache_htable_free - Free the hash tables
• • @digest_cache: Digest cache
• • This function removes all digests from all hash tables in the digest cache,
• • and frees the memory.
• */

+void digest_cache_htable_free(struct digest_cache *digest_cache) +{

• struct htable *h, *h_tmp;
• struct digest_cache_entry *p;
• struct hlist_node *q;
• int i;
• list_for_each_entry_safe(h, h_tmp, &digest_cache->htables, next) {

• for (i = 0; i < h->num_slots; i++) {
  

• 	hlist_for_each_entry_safe(p, q, &h->slots[i], hnext) {
  

• 		hlist_del(&p->hnext);
  

• 		pr_debug("Removed digest %s:%*phN from digest cache %s\n",
  

• 			 hash_algo_name[h->algo],
  

• 			 hash_digest_size[h->algo], p->digest,
  

• 			 digest_cache->path_str);
  

• 		kfree(p);
  

• 	}
  

• }
  

• list_del(&h->next);
  

• kfree(h->slots);
  

• kfree(h);
  

• }

+} diff --git a/security/digest_cache/internal.h b/security/digest_cache/internal.h index bbf5eefe5c82..f6ffeaa25288 100644 --- a/security/digest_cache/internal.h +++ b/security/digest_cache/internal.h @@ -16,8 +16,40 @@ /* Digest cache bits in flags. */ #define INIT_IN_PROGRESS 0 /* Digest cache being initialized. */ +/**

• • struct digest_cache_entry - Entry of a digest cache hash table
• • @hnext: Pointer to the next element in the collision list
• • @digest: Stored digest
• • This structure represents an entry of a digest cache hash table, storing a
• • digest.
• */

+struct digest_cache_entry {

• struct hlist_node hnext;
• u8 digest[];

+} __packed;

Please correct me if I'm wrong but I don't think __packed has any use here as the definition of hlist_node is:

struct hlist_node { struct hlist_node *next, **pprev; };

It is naturally aligned to begin with.

You're right. __packed is not needed (no reordering).

Thanks

Roberto

...

+/**

• • struct htable - Hash table
• • @next: Next hash table in the linked list
• • @slots: Hash table slots
• • @num_slots: Number of slots
• • @num_digests: Number of digests stored in the hash table
• • @algo: Algorithm of the digests
• • This structure is a hash table storing digests of file data or metadata.
• */

+struct htable {

• struct list_head next;
• struct hlist_head *slots;
• unsigned int num_slots;
• u64 num_digests;
• enum hash_algo algo;

+};

• /**
  • struct digest_cache - Digest cache
• • @htables: Hash tables (one per algorithm)
  • @ref_count: Number of references to the digest cache
  • @path_str: Path of the digest list the digest cache was created from
  • @flags: Control flags

@@ -25,6 +57,7 @@

• This structure represents a cache of digests extracted from a digest list.

*/ struct digest_cache {

• struct list_head htables; atomic_t ref_count; char *path_str; unsigned long flags;

@@ -84,4 +117,14 @@ struct digest_cache *digest_cache_create(struct dentry *dentry, struct path *digest_list_path, char *path_str, char *filename); +/* htable.c */ +int digest_cache_htable_init(struct digest_cache *digest_cache, u64 num_digests,

• 	     enum hash_algo algo);
  

+int digest_cache_htable_add(struct digest_cache *digest_cache, u8 *digest,

• 	    enum hash_algo algo);
  

+int digest_cache_htable_lookup(struct dentry *dentry,

• 	       struct digest_cache *digest_cache, u8 *digest,
  

• 	       enum hash_algo algo);
  

+void digest_cache_htable_free(struct digest_cache *digest_cache);

• #endif /* _DIGEST_CACHE_INTERNAL_H */

diff --git a/security/digest_cache/main.c b/security/digest_cache/main.c index 661c8d106791..0b201af6432c 100644 --- a/security/digest_cache/main.c +++ b/security/digest_cache/main.c @@ -48,6 +48,7 @@ static struct digest_cache *digest_cache_alloc_init(char *path_str, atomic_set(&digest_cache->ref_count, 1); digest_cache->flags = 0UL;

• INIT_LIST_HEAD(&digest_cache->htables);

pr_debug("New digest cache %s (ref count: %d)\n", digest_cache->path_str, atomic_read(&digest_cache->ref_count)); @@ -63,6 +64,8 @@ static struct digest_cache *digest_cache_alloc_init(char *path_str, */ static void digest_cache_free(struct digest_cache *digest_cache) {

• digest_cache_htable_free(digest_cache);
• pr_debug("Freed digest cache %s\n", digest_cache->path_str); kfree(digest_cache->path_str); kmem_cache_free(digest_cache_cache, digest_cache);

BR, Jarkko

On Mon Apr 15, 2024 at 5:24 PM EEST, Roberto Sassu wrote:

From: Roberto Sassu roberto.sassu@huawei.com

In the environments where xattrs are not available (e.g. in the initial ram disk), the digest_cache LSM cannot precisely determine which digest list in a directory contains the desired reference digest. However, although slower, it would be desirable to search the digest in all digest lists of that directory.

This done in two steps. When a digest cache is being created, digest_cache_create() invokes digest_cache_dir_create(), to generate the list of current directory entries. Entries are placed in the list in ascending order by the <seq num> if prepended to the file name, or at the end of the list if not.

The resulting digest cache has the IS_DIR bit set, to distinguish it from the digest caches created from regular files.

Second, when a digest is searched in a directory digest cache, digest_cache_lookup() invokes digest_cache_dir_lookup_digest() to iteratively search that digest in each directory entry generated by digest_cache_dir_create().

That list is stable, even if new files are added or deleted from that directory. A subsequent patch will invalidate the digest cache, forcing next callers of digest_cache_get() to get a new directory digest cache with the updated list of directory entries.

If the current directory entry does not have a digest cache reference, digest_cache_dir_lookup_digest() invokes digest_cache_create() to create a new digest cache for that entry. In either case, digest_cache_dir_lookup_digest() calls then digest_cache_htable_lookup() with the new/existing digest cache to search the digest. Check and assignment of the digest cache in a directory entry is protected by the per entry digest_cache_mutex.

The iteration stops when the digest is found. In that case, digest_cache_dir_lookup_digest() returns the digest cache reference of the current directory entry as the digest_cache_found_t type, so that callers of digest_cache_lookup() don't mistakenly try to call digest_cache_put() with that reference.

This new reference type will be used to retrieve information about the digest cache containing the digest, which is not known in advance until the digest search is performed.

The order of the list of directory entries influences the speed of the digest search. A search terminates faster if less digest caches have to be created. One way to optimize it could be to order the list of digest lists in the same way of when they are requested at boot.

Finally, digest_cache_dir_free() releases the digest cache references stored in the list of directory entries, and frees the list itself.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com

security/digest_cache/Makefile | 2 +- security/digest_cache/dir.c | 193 +++++++++++++++++++++++++++++++ security/digest_cache/htable.c | 22 +++- security/digest_cache/internal.h | 45 +++++++ security/digest_cache/main.c | 12 ++ 5 files changed, 271 insertions(+), 3 deletions(-) create mode 100644 security/digest_cache/dir.c

diff --git a/security/digest_cache/Makefile b/security/digest_cache/Makefile index 37a473c7bc28..e417da0383ab 100644 --- a/security/digest_cache/Makefile +++ b/security/digest_cache/Makefile @@ -4,7 +4,7 @@ obj-$(CONFIG_SECURITY_DIGEST_CACHE) += digest_cache.o -digest_cache-y := main.o secfs.o htable.o populate.o modsig.o verif.o +digest_cache-y := main.o secfs.o htable.o populate.o modsig.o verif.o dir.o digest_cache-y += parsers/tlv.o digest_cache-y += parsers/rpm.o diff --git a/security/digest_cache/dir.c b/security/digest_cache/dir.c new file mode 100644 index 000000000000..7bfcdd5f7ef1 --- /dev/null +++ b/security/digest_cache/dir.c @@ -0,0 +1,193 @@ +// SPDX-License-Identifier: GPL-2.0 +/*

• • Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
• • Author: Roberto Sassu roberto.sassu@huawei.com
• • Manage digest caches from directories.
• */

+#define pr_fmt(fmt) "DIGEST CACHE: "fmt +#include <linux/init_task.h>

+#include "internal.h"

+/**

• • digest_cache_dir_iter - Digest cache directory iterator
• • @__ctx: iterate_dir() context
• • @name: Name of file in the accessed directory
• • @namelen: String length of @name
• • @offset: Current position in the directory stream (see man readdir)
• • @ino: Inode number
• • @d_type: File type
• • This function stores the names of the files in the containing directory in
• • a linked list. If they are in the format <seq num>-<format>-<name>, this
• • function orders them by seq num, so that digest lists are processed in the
• • desired order. Otherwise, if <seq num>- is not included, it adds the name at
• • the end of the list.
• • Return: True to continue processing, false to stop.
• */

+static bool digest_cache_dir_iter(struct dir_context *__ctx, const char *name,

• 		  int namelen, loff_t offset, u64 ino,
  

• 		  unsigned int d_type)
  

+{

• struct readdir_callback *ctx = container_of(__ctx, typeof(*ctx), ctx);
• struct dir_entry *new_entry, *p;
• unsigned int seq_num;
• char *separator;
• int ret;
• if (!strcmp(name, ".") || !strcmp(name, ".."))

• return true;
  

• if (d_type != DT_REG)

• return true;
  

• new_entry = kmalloc(sizeof(*new_entry) + namelen + 1, GFP_KERNEL);
• if (!new_entry)

• return false;
  

• memcpy(new_entry->name, name, namelen);
• new_entry->name[namelen] = '\0';
• new_entry->seq_num = UINT_MAX;
• new_entry->digest_cache = NULL;
• mutex_init(&new_entry->digest_cache_mutex);
• if (new_entry->name[0] < '0' || new_entry->name[0] > '9')

• goto out;
  

• separator = strchr(new_entry->name, '-');
• if (!separator)

• goto out;
  

• *separator = '\0';
• ret = kstrtouint(new_entry->name, 10, &seq_num);
• *separator = '-';
• if (ret < 0)

• goto out;
  

• new_entry->seq_num = seq_num;
• list_for_each_entry(p, ctx->head, list) {

• if (seq_num <= p->seq_num) {
  

• 	list_add(&new_entry->list, p->list.prev);
  

• 	pr_debug("Added %s before %s in dir list\n",
  

• 		 new_entry->name, p->name);
  

• 	return true;
  

• }
  

• }

+out:

• list_add_tail(&new_entry->list, ctx->head);
• pr_debug("Added %s to tail of dir list\n", new_entry->name);
• return true;

+}

+/**

• • digest_cache_dir_create - Create a directory digest cache
• • @digest_cache: Digest cache
• • @digest_list_path: Path structure of the digest list directory
• • This function iterates over the entries of a directory, and creates a linked
• • list of file names from that directory.
• • Return: Zero on success, a POSIX error code otherwise.
• */

+int digest_cache_dir_create(struct digest_cache *digest_cache,

• 	    struct path *digest_list_path)
  

+{

• struct file *dir_file;
• struct readdir_callback buf = {

• .ctx.actor = digest_cache_dir_iter,
  

• };
• int ret;
• dir_file = dentry_open(digest_list_path, O_RDONLY, &init_cred);
• if (IS_ERR(dir_file)) {

• pr_debug("Cannot access %s, ret: %ld\n", digest_cache->path_str,
  

• 	 PTR_ERR(dir_file));
  

• return PTR_ERR(dir_file);
  

• }
• buf.head = &digest_cache->dir_entries;
• ret = iterate_dir(dir_file, &buf.ctx);
• if (ret < 0)

• pr_debug("Failed to iterate directory %s\n",
  

• 	 digest_cache->path_str);
  

• fput(dir_file);
• return ret;

+}

+/**

• • digest_cache_dir_lookup_digest - Lookup a digest
• • @dentry: Dentry of the file whose digest is looked up
• • @digest_list_path: Path structure of the digest list directory
• • @digest_cache: Digest cache
• • @digest: Digest to search
• • @algo: Algorithm of the digest to search
• • This function iterates over the linked list created by
• • digest_cache_dir_create() and looks up the digest in the digest cache of
• • each entry.
• • Return: A digest_cache_found_t value if the digest if found, zero otherwise.
• */

+digest_cache_found_t +digest_cache_dir_lookup_digest(struct dentry *dentry,

• 	       struct path *digest_list_path,
  

• 	       struct digest_cache *digest_cache, u8 *digest,
  

• 	       enum hash_algo algo)
  

+{

• struct digest_cache *cache;
• struct dir_entry *dir_entry;
• int ret;
• list_for_each_entry(dir_entry, &digest_cache->dir_entries, list) {

• mutex_lock(&dir_entry->digest_cache_mutex);
  

• if (!dir_entry->digest_cache) {
  

• 	cache = digest_cache_create(dentry, digest_list_path,
  

• 				    digest_cache->path_str,
  

• 				    dir_entry->name);
  

• 	/* Ignore digest caches that cannot be instantiated. */
  

• 	if (!cache) {
  

• 		mutex_unlock(&dir_entry->digest_cache_mutex);
  

• 		continue;
  

• 	}
  

• 	/* Consume extra ref. from digest_cache_create(). */
  

• 	dir_entry->digest_cache = cache;
  

• }
  

• mutex_unlock(&dir_entry->digest_cache_mutex);
  

• ret = digest_cache_htable_lookup(dentry,
  

• 				 dir_entry->digest_cache,
  

• 				 digest, algo);
  

• if (!ret)
  

• 	return (digest_cache_found_t)dir_entry->digest_cache;
  

• }
• return 0UL;

+}

+/**

• • digest_cache_dir_free - Free the stored file list and put digest caches
• • @digest_cache: Digest cache
• • This function frees the file list created by digest_cache_create(), and puts
• • the digest cache if a reference exists.
• */

+void digest_cache_dir_free(struct digest_cache *digest_cache) +{

• struct dir_entry *p, *q;
• list_for_each_entry_safe(p, q, &digest_cache->dir_entries, list) {

• if (p->digest_cache)
  

• 	digest_cache_put(p->digest_cache);
  

• list_del(&p->list);
  

• mutex_destroy(&p->digest_cache_mutex);
  

• kfree(p);
  

• }

+} diff --git a/security/digest_cache/htable.c b/security/digest_cache/htable.c index d2d5d8f5e5b1..8cf7400dfcf4 100644 --- a/security/digest_cache/htable.c +++ b/security/digest_cache/htable.c @@ -8,6 +8,8 @@ */ #define pr_fmt(fmt) "DIGEST CACHE: "fmt +#include <linux/namei.h>

#include "internal.h" /** @@ -210,10 +212,26 @@ digest_cache_found_t digest_cache_lookup(struct dentry *dentry, struct digest_cache *digest_cache, u8 *digest, enum hash_algo algo) {

• struct path digest_list_path;
• digest_cache_found_t found; int ret;

• ret = digest_cache_htable_lookup(dentry, digest_cache, digest, algo);
• return (!ret) ? (digest_cache_found_t)digest_cache : 0UL;

• if (!test_bit(IS_DIR, &digest_cache->flags)) {

• ret = digest_cache_htable_lookup(dentry, digest_cache, digest,
  

• 				 algo);
  

• return (!ret) ? (digest_cache_found_t)digest_cache : 0UL;