Changes in loadpin.c

8152f820 - fdget(), more trivial conversions

Sat, 20 Jul 2024 01:19:02 +0000

fdget(), more trivial conversionsall failure exits prior to fdget() leave the scope, all matching fdput()are immediately followed by leaving the scope.[xfs_ioc_commit_range() chunk moved here as well]Reviewed-by: Christian Brauner Signed-off-by: Al Viro List of files: /linux-6.15/security/loadpin/loadpin.c

1da91ea8 - introduce fd_file(), convert all accessors to it.

Fri, 31 May 2024 18:12:01 +0000

introduce fd_file(), convert all accessors to it. For any changes of struct fd representation we need toturn existing accesses to fields into calls of wrappers.Accesses to struct fd::flags are very few (3 in linux/file.h,1 in net/socket.c, 3 in fs/overlayfs/file.c and 3 more inexplicit initializers). Those can be dealt with in the commit converting tonew layout; accesses to struct fd::file are too many for that. This commit converts (almost) all of f.file tofd_file(f). It's not entirely mechanical ('file' is used asa member name more than just in struct fd) and it does noteven attempt to distinguish the uses in pointer context fromthose in boolean context; the latter will be eventually turnedinto a separate helper (fd_empty()). NOTE: mass conversion to fd_empty(), tempting as itmight be, is a bad idea; better do that piecewise in committhat convert from fdget...() to CLASS(...).[conflicts in fs/fhandle.c, kernel/bpf/syscall.c, mm/memcontrol.ccaught by git; fs/stat.c one got caught by git grep][fs/xattr.c conflict]Reviewed-by: Christian Brauner Signed-off-by: Al Viro List of files: /linux-6.15/security/loadpin/loadpin.c

74560bb3 - lsm: remove the now superfluous sentinel element from ctl_table array

Thu, 28 Mar 2024 15:57:49 +0000

lsm: remove the now superfluous sentinel element from ctl_table arrayThis commit comes at the tail end of a greater effort to remove theempty elements at the end of the ctl_table arrays (sentinels) which willreduce the overall build time size of the kernel and run time memorybloat by ~64 bytes per sentinel (further information Link :https://lore.kernel.org/all/ZO5Yx5JFogGi%2FcBo@bombadil.infradead.org/)Remove the sentinel from all files under security/ that register asysctl table.Signed-off-by: Joel Granados Acked-by: Kees Cook # loadpin & yamaTested-by: Valentin Schneider Reviewed-by: Valentin Schneider [PM: subject line tweaks]Signed-off-by: Paul Moore List of files: /linux-6.15/security/loadpin/loadpin.c

b1a867ee - lsm: mark the lsm_id variables are marked as static

Fri, 10 Nov 2023 17:09:33 +0000

lsm: mark the lsm_id variables are marked as staticAs the kernel test robot helpfully reminded us, all of the lsm_idinstances defined inside the various LSMs should be marked as static.The one exception is Landlock which uses its lsm_id variable acrossmultiple source files with an extern declaration in a header file.Reported-by: kernel test robot Suggested-by: Casey Schaufler Reviewed-by: Casey Schaufler Signed-off-by: Paul Moore List of files: /linux-6.15/security/loadpin/loadpin.c

f3b8788c - LSM: Identify modules by more than name

Tue, 12 Sep 2023 20:56:46 +0000

LSM: Identify modules by more than nameCreate a struct lsm_id to contain identifying information about LinuxSecurity Modules (LSMs). At inception this contains the name of themodule and an identifier associated with the security module. Changethe security_add_hooks() interface to use this structure. Change theindividual modules to maintain their own struct lsm_id and pass it tosecurity_add_hooks().The values are for LSM identifiers are defined in a new UAPIheader file linux/lsm.h. Each existing LSM has been updated toinclude it's LSMID in the lsm_id.The LSM ID values are sequential, with the oldest moduleLSM_ID_CAPABILITY being the lowest value and the existing modulesnumbered in the order they were included in the main line kernel.This is an arbitrary convention for assigning the values, butnone better presents itself. The value 0 is defined as being invalid.The values 1-99 are reserved for any special case uses which mayarise in the future. This may include attributes of the LSMinfrastructure itself, possibly related to namespacing or networkattribute management. A special range is identified for such attributesto help reduce confusion for developers unfamiliar with LSMs.LSM attribute values are defined for the attributes presented bymodules that are available today. As with the LSM IDs, The value 0is defined as being invalid. The values 1-99 are reserved for anyspecial case uses which may arise in the future.Cc: linux-security-module Signed-off-by: Casey Schaufler Reviewed-by: Kees Cook Reviewed-by: Serge Hallyn Reviewed-by: Mickael Salaun Reviewed-by: John Johansen Signed-off-by: Kees Cook Nacked-by: Tetsuo Handa [PM: forward ported beyond v6.6 due merge window changes]Signed-off-by: Paul Moore List of files: /linux-6.15/security/loadpin/loadpin.c

5f536ac6 - LoadPin: Annotate struct dm_verity_loadpin_trusted_root_digest with __counted_by

Thu, 17 Aug 2023 23:59:56 +0000

LoadPin: Annotate struct dm_verity_loadpin_trusted_root_digest with __counted_byPrepare for the coming implementation by GCC and Clang of the __counted_byattribute. Flexible array members annotated with __counted_by can havetheir accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS(for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-familyfunctions).As found with Coccinelle[1], add __counted_by for struct dm_verity_loadpin_trusted_root_digest.Additionally, since the element count member must be set before accessingthe annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocciCc: Alasdair Kergon Cc: Mike Snitzer Cc: dm-devel@redhat.comCc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.orgLink: https://lore.kernel.org/r/20230817235955.never.762-kees@kernel.orgSigned-off-by: Kees Cook List of files: /linux-6.15/security/loadpin/loadpin.c

5df5bdc3 - loadpin: simplify sysctls use with register_sysctl()

Thu, 02 Mar 2023 20:28:20 +0000

loadpin: simplify sysctls use with register_sysctl()register_sysctl_paths() is not required, we can just useregister_sysctl() with the required path specified.Reviewed-by: John Johansen Acked-by: Kees Cook Signed-off-by: Luis Chamberlain List of files: /linux-6.15/security/loadpin/loadpin.c

f22f9aaf - selinux: remove the runtime disable functionality

Fri, 17 Mar 2023 16:43:07 +0000

selinux: remove the runtime disable functionalityAfter working with the larger SELinux-based distros for severalyears, we're finally at a place where we can disable the SELinuxruntime disable functionality. The existing kernel deprecationnotice explains the functionality and why we want to remove it: The selinuxfs "disable" node allows SELinux to be disabled at runtime prior to a policy being loaded into the kernel. If disabled via this mechanism, SELinux will remain disabled until the system is rebooted. The preferred method of disabling SELinux is via the "selinux=0" boot parameter, but the selinuxfs "disable" node was created to make it easier for systems with primitive bootloaders that did not allow for easy modification of the kernel command line. Unfortunately, allowing for SELinux to be disabled at runtime makes it difficult to secure the kernel's LSM hooks using the "__ro_after_init" feature.It is that last sentence, mentioning the '__ro_after_init' hardening,which is the real motivation for this change, and if you look at thediffstat you'll see that the impact of this patch reaches across allthe different LSMs, helping prevent tampering at the LSM hook level.From a SELinux perspective, it is important to note that if youcontinue to disable SELinux via "/etc/selinux/config" it may appearthat SELinux is disabled, but it is simply in an uninitialized state.If you load a policy with `load_policy -i`, you will see SELinuxcome alive just as if you had loaded the policy during early-boot.It is also worth noting that the "/sys/fs/selinux/disable" file isalways writable now, regardless of the Kconfig settings, but writingto the file has no effect on the system, other than to display anerror on the console if a non-zero/true value is written.Finally, in the several years where we have been working ondeprecating this functionality, there has only been one instance ofsomeone mentioning any user visible breakage. In this particularcase it was an individual's kernel test system, and the workarounddocumented in the deprecation notice ("selinux=0" on the kernelcommand line) resolved the issue without problem.Acked-by: Casey Schaufler Signed-off-by: Paul Moore List of files: /linux-6.15/security/loadpin/loadpin.c

eba77359 - LoadPin: Allow filesystem switch when not enforcing

Fri, 09 Dec 2022 19:57:45 +0000

LoadPin: Allow filesystem switch when not enforcingFor LoadPin to be used at all in a classic distro environment, it needsto allow for switching filesystems (from the initramfs to the "real"root filesystem). To allow for this, if the "enforce" mode is not set atboot, reset the pinned filesystem tracking when the pinned filesystemgets unmounted instead of invalidating further loads. Once enforcementis set, it cannot be unset, and the pinning will stick.This means that distros can build with CONFIG_SECURITY_LOADPIN=y, but withCONFIG_SECURITY_LOADPIN_ENFORCE disabled, but after boot is running,the system can enable enforcement: $ sysctl -w kernel.loadpin.enforced=1Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.orgSigned-off-by: Kees Cook Reviewed-by: Serge Hallyn Link: https://lore.kernel.org/r/20221209195746.1366607-4-keescook@chromium.org List of files: /linux-6.15/security/loadpin/loadpin.c

2cfaa84e - LoadPin: Move pin reporting cleanly out of locking

Fri, 09 Dec 2022 19:57:44 +0000

LoadPin: Move pin reporting cleanly out of lockingRefactor the pin reporting to be more cleanly outside the locking. Itwas already, but moving it around helps clear the path for the root toswitch when not enforcing.Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.orgSigned-off-by: Kees Cook Reviewed-by: Serge Hallyn Link: https://lore.kernel.org/r/20221209195746.1366607-3-keescook@chromium.org List of files: /linux-6.15/security/loadpin/loadpin.c

60ba1028 - LoadPin: Refactor sysctl initialization

Fri, 09 Dec 2022 19:57:43 +0000

LoadPin: Refactor sysctl initializationIn preparation for shifting root mount when not enforcing, split sysctllogic out into a separate helper, and unconditionally register thesysctl, but only make it writable when the device is writable.Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.orgSigned-off-by: Kees Cook Reviewed-by: Serge Hallyn Link: https://lore.kernel.org/r/20221209195746.1366607-2-keescook@chromium.org List of files: /linux-6.15/security/loadpin/loadpin.c

b76ded21 - LoadPin: Refactor read-only check into a helper

Fri, 09 Dec 2022 19:57:42 +0000

LoadPin: Refactor read-only check into a helperIn preparation for allowing mounts to shift when not enforced, moveread-only checking into a separate helper.Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.orgSigned-off-by: Kees Cook Reviewed-by: Serge Hallyn Link: https://lore.kernel.org/r/20221209195746.1366607-1-keescook@chromium.org List of files: /linux-6.15/security/loadpin/loadpin.c

1a17e5b5 - LoadPin: Ignore the "contents" argument of the LSM hooks

Fri, 09 Dec 2022 19:54:57 +0000

LoadPin: Ignore the "contents" argument of the LSM hooksLoadPin only enforces the read-only origin of kernel file reads. Whetheror not it was a partial read isn't important. Remove the overlyconservative checks so that things like partial firmware reads willsucceed (i.e. reading a firmware header).Fixes: 2039bda1fa8d ("LSM: Add "contents" flag to kernel_read_file hook")Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.orgSigned-off-by: Kees Cook Acked-by: Serge Hallyn Tested-by: Ping-Ke Shih Link: https://lore.kernel.org/r/20221209195453.never.494-kees@kernel.org List of files: /linux-6.15/security/loadpin/loadpin.c

6e42aec7 - LoadPin: Require file with verity root digests to have a header

Wed, 07 Sep 2022 01:18:12 +0000

LoadPin: Require file with verity root digests to have a headerLoadPin expects the file with trusted verity root digests to bean ASCII file with one digest (hex value) per line. A pinnedroot could contain files that meet these format requirements,even though the hex values don't represent trusted rootdigests.Add a new requirement to the file format which consists inthe first line containing a fixed string. This preventsattackers from feeding files with an otherwise valid formatto LoadPin.Suggested-by: Sarthak Kukreti Signed-off-by: Matthias Kaehlcke Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220906181725.1.I3f51d1bb0014e5a5951be4ad3c5ad7c7ca1dfc32@changeid List of files: /linux-6.15/security/loadpin/loadpin.c

6a3981af - LoadPin: Return EFAULT on copy_from_user() failures

Tue, 16 Aug 2022 19:14:54 +0000

LoadPin: Return EFAULT on copy_from_user() failuresThe copy_from_user() function returns the number of bytes remaining tobe copied on a failure. Such failures should return -EFAULT to highlevels.Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: 3f805f8cc23b ("LoadPin: Enable loading from trusted dm-verity devices")Cc: Matthias Kaehlcke Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.orgSigned-off-by: Kees Cook List of files: /linux-6.15/security/loadpin/loadpin.c

3f805f8c - LoadPin: Enable loading from trusted dm-verity devices

Mon, 27 Jun 2022 15:35:25 +0000

LoadPin: Enable loading from trusted dm-verity devicesExtend LoadPin to allow loading of kernel files from trusted dm-verity [1]devices.This change adds the concept of trusted verity devices to LoadPin. LoadPinmaintains a list of root digests of verity devices it considers trusted.Userspace can populate this list through an ioctl on the new LoadPinsecurityfs entry 'dm-verity'. The ioctl receives a file descriptor ofa file with verity digests as parameter. Verity reads the digests fromthis file after confirming that the file is located on the pinned root.The digest file must contain one digest per line. The list of trusteddigests can only be set up once, which is typically done at boot time.When a kernel file is read LoadPin first checks (as usual) whether the fileis located on the pinned root, if so the file can be loaded. Otherwise, ifthe verity extension is enabled, LoadPin determines whether the file islocated on a verity backed device and whether the root digest of thatdevice is in the list of trusted digests. The file can be loaded if theverity device has a trusted root digest.Background:As of now LoadPin restricts loading of kernel files to a single pinnedfilesystem, typically the rootfs. This works for many systems, however itcan result in a bloated rootfs (and OTA updates) on platforms wheremultiple boards with different hardware configurations use the same rootfsimage. Especially when 'optional' files are large it may be preferable todownload/install them only when they are actually needed by a given board.Chrome OS uses Downloadable Content (DLC) [2] to deploy certain 'packages'at runtime. As an example a DLC package could contain firmware for aperipheral that is not present on all boards. DLCs use dm-verity to verifythe integrity of the DLC content.[1] https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html[2] https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.mdSigned-off-by: Matthias Kaehlcke Acked-by: Mike Snitzer Link: https://lore.kernel.org/lkml/20220627083512.v7.2.I01c67af41d2f6525c6d023101671d7339a9bc8b5@changeidSigned-off-by: Kees Cook List of files: /linux-6.15/security/loadpin/loadpin.c

ed5edd5a - loadpin: stop using bdevname

Thu, 12 May 2022 06:20:14 +0000

loadpin: stop using bdevnameUse the %pg format specifier to save on stack consuption and code size.Signed-off-by: Christoph Hellwig Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220512062014.1826835-1-hch@lst.de List of files: /linux-6.15/security/loadpin/loadpin.c

2039bda1 - LSM: Add "contents" flag to kernel_read_file hook

Fri, 02 Oct 2020 17:38:23 +0000

LSM: Add "contents" flag to kernel_read_file hookAs with the kernel_load_data LSM hook, add a "contents" flag to thekernel_read_file LSM hook that indicates whether the LSM can expecta matching call to the kernel_post_read_file LSM hook with the fullcontents of the file. With the coming addition of partial file readsupport for kernel_read_file*() API, the LSM will no longer be ableto always see the entire contents of a file during the read calls.For cases where the LSM must read examine the complete file contents,it will need to do so on its own every time the kernel_read_filehook is called with contents=false (or reject such cases). Adjust allexisting LSMs to retain existing behavior.Signed-off-by: Kees Cook Reviewed-by: Mimi Zohar Link: https://lore.kernel.org/r/20201002173828.2099543-12-keescook@chromium.orgSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/loadpin/loadpin.c

b64fcae7 - LSM: Introduce kernel_post_load_data() hook

Fri, 02 Oct 2020 17:38:20 +0000

LSM: Introduce kernel_post_load_data() hookThere are a few places in the kernel where LSMs would like to havevisibility into the contents of a kernel buffer that has been loaded orread. While security_kernel_post_read_file() (which includes thebuffer) exists as a pairing for security_kernel_read_file(), no suchhook exists to pair with security_kernel_load_data().Earlier proposals for just using security_kernel_post_read_file() with aNULL file argument were rejected (i.e. "file" should always be valid forthe security_..._file hooks, but it appears at least one case wasleft in the kernel during earlier refactoring. (This will be fixed ina subsequent patch.)Since not all cases of security_kernel_load_data() can have a singlecontiguous buffer made available to the LSM hook (e.g. kexec imagesegments are separately loaded), there needs to be a way for the LSM toreason about its expectations of the hook coverage. In order to handlethis, add a "contents" argument to the "kernel_load_data" hook thatindicates if the newly added "kernel_post_load_data" hook will be calledwith the full contents once loaded. That way, LSMs requiring full contentscan choose to unilaterally reject "kernel_load_data" with contents=false(which is effectively the existing hook coverage), but when contents=truethey can allow it and later evaluate the "kernel_post_load_data" hookonce the buffer is loaded.With this change, LSMs can gain coverage over non-file-backed data loads(e.g. init_module(2) and firmware userspace helper), which will happenin subsequent patches.Additionally prepare IMA to start processing these cases.Signed-off-by: Kees Cook Reviewed-by: KP Singh Link: https://lore.kernel.org/r/20201002173828.2099543-9-keescook@chromium.orgSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/loadpin/loadpin.c

b89999d0 - fs/kernel_read_file: Split into separate include file

Fri, 02 Oct 2020 17:38:15 +0000

fs/kernel_read_file: Split into separate include fileMove kernel_read_file* out of linux/fs.h to its own linux/kernel_read_file.hinclude file. That header gets pulled in just about everywhereand doesn't really need functions not related to the general fs interface.Suggested-by: Christoph Hellwig Signed-off-by: Scott Branden Signed-off-by: Kees Cook Reviewed-by: Christoph Hellwig Reviewed-by: Mimi Zohar Reviewed-by: Luis Chamberlain Acked-by: Greg Kroah-Hartman Acked-by: James Morris Link: https://lore.kernel.org/r/20200706232309.12010-2-scott.branden@broadcom.comLink: https://lore.kernel.org/r/20201002173828.2099543-4-keescook@chromium.orgSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/loadpin/loadpin.c