Commit c200892b authored by Coiby Xu's avatar Coiby Xu Committed by Mimi Zohar
Browse files

ima: Access decompressed kernel module to verify appended signature 



Currently, when in-kernel module decompression (CONFIG_MODULE_DECOMPRESS)
is enabled, IMA has no way to verify the appended module signature as it
can't decompress the module.

Define a new kernel_read_file_id enumerate READING_MODULE_COMPRESSED so
IMA can calculate the compressed kernel module data hash on
READING_MODULE_COMPRESSED and defer appraising/measuring it until on
READING_MODULE when the module has been decompressed.

Before enabling in-kernel module decompression, a kernel module in
initramfs can still be loaded with ima_policy=secure_boot. So adjust the
kernel module rule in secure_boot policy to allow either an IMA
signature OR an appended signature i.e. to use
"appraise func=MODULE_CHECK appraise_type=imasig|modsig".

Reported-by: default avatarKarel Srot <ksrot@redhat.com>
Suggested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Suggested-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarCoiby Xu <coxu@redhat.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 43369273

include/linux/kernel_read_file.h

+1 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
	id(KEXEC_INITRAMFS, kexec-initramfs)	\

	id(POLICY, security-policy)		\

	id(X509_CERTIFICATE, x509-certificate)	\

	id(MODULE_COMPRESSED, kernel-module-compressed) \

	id(MAX_ID, )



#define __fid_enumify(ENUM, dummy) READING_ ## ENUM,

kernel/module/main.c

+14 −3
Original line number Diff line number Diff line
@@ -3675,24 +3675,35 @@ static int idempotent_wait_for_completion(struct idempotent *u) 


static int init_module_from_file(struct file *f, const char __user * uargs, int flags)

{

	bool compressed = !!(flags & MODULE_INIT_COMPRESSED_FILE);

	struct load_info info = { };

	void *buf = NULL;

	int len;

	int err;



	len = kernel_read_file(f, 0, &buf, INT_MAX, NULL, READING_MODULE);

	len = kernel_read_file(f, 0, &buf, INT_MAX, NULL,

			       compressed ? READING_MODULE_COMPRESSED :

					    READING_MODULE);

	if (len < 0) {

		mod_stat_inc(&failed_kreads);

		return len;

	}



	if (flags & MODULE_INIT_COMPRESSED_FILE) {

		int err = module_decompress(&info, buf, len);

	if (compressed) {

		err = module_decompress(&info, buf, len);

		vfree(buf); /* compressed data is no longer needed */

		if (err) {

			mod_stat_inc(&failed_decompress);

			mod_stat_add_long(len, &invalid_decompress_bytes);

			return err;

		}

		err = security_kernel_post_read_file(f, (char *)info.hdr, info.len,

						     READING_MODULE);

		if (err) {

			mod_stat_inc(&failed_kreads);

			free_copy(&info, flags);

			return err;

		}

	} else {

		info.hdr = buf;

		info.len = len;

security/integrity/ima/ima_main.c

+16 −8
Original line number Diff line number Diff line
@@ -235,7 +235,8 @@ static void ima_file_free(struct file *file) 


static int process_measurement(struct file *file, const struct cred *cred,

			       struct lsm_prop *prop, char *buf, loff_t size,

			       int mask, enum ima_hooks func)

			       int mask, enum ima_hooks func,

			       enum kernel_read_file_id read_id)

{

	struct inode *real_inode, *inode = file_inode(file);

	struct ima_iint_cache *iint = NULL;
@@ -406,6 +407,12 @@ static int process_measurement(struct file *file, const struct cred *cred, 
	if (rc != 0 && rc != -EBADF && rc != -EINVAL)

		goto out_locked;



	/* Defer measuring/appraising kernel modules to READING_MODULE */

	if (read_id == READING_MODULE_COMPRESSED) {

		must_appraise = 0;

		goto out_locked;

	}



	if (!pathbuf)	/* ima_rdwr_violation possibly pre-fetched */

		pathname = ima_d_path(&file->f_path, &pathbuf, filename);
@@ -486,14 +493,14 @@ static int ima_file_mmap(struct file *file, unsigned long reqprot, 


	if (reqprot & PROT_EXEC) {

		ret = process_measurement(file, current_cred(), &prop, NULL,

					  0, MAY_EXEC, MMAP_CHECK_REQPROT);

					  0, MAY_EXEC, MMAP_CHECK_REQPROT, 0);

		if (ret)

			return ret;

	}



	if (prot & PROT_EXEC)

		return process_measurement(file, current_cred(), &prop, NULL,

					   0, MAY_EXEC, MMAP_CHECK);

					   0, MAY_EXEC, MMAP_CHECK, 0);



	return 0;

}
@@ -577,7 +584,7 @@ static int ima_bprm_check(struct linux_binprm *bprm) 


	security_current_getlsmprop_subj(&prop);

	return process_measurement(bprm->file, current_cred(),

				   &prop, NULL, 0, MAY_EXEC, BPRM_CHECK);

				   &prop, NULL, 0, MAY_EXEC, BPRM_CHECK, 0);

}



/**
@@ -607,7 +614,7 @@ static int ima_creds_check(struct linux_binprm *bprm, const struct file *file) 


	security_current_getlsmprop_subj(&prop);

	return process_measurement((struct file *)file, bprm->cred, &prop, NULL,

				   0, MAY_EXEC, CREDS_CHECK);

				   0, MAY_EXEC, CREDS_CHECK, 0);

}



/**
@@ -655,7 +662,7 @@ static int ima_file_check(struct file *file, int mask) 
	security_current_getlsmprop_subj(&prop);

	return process_measurement(file, current_cred(), &prop, NULL, 0,

				   mask & (MAY_READ | MAY_WRITE | MAY_EXEC |

					   MAY_APPEND), FILE_CHECK);

					   MAY_APPEND), FILE_CHECK, 0);

}



static int __ima_inode_hash(struct inode *inode, struct file *file, char *buf,
@@ -874,12 +881,13 @@ static int ima_read_file(struct file *file, enum kernel_read_file_id read_id, 
	func = read_idmap[read_id] ?: FILE_CHECK;

	security_current_getlsmprop_subj(&prop);

	return process_measurement(file, current_cred(), &prop, NULL, 0,

				   MAY_READ, func);

				   MAY_READ, func, 0);

}



const int read_idmap[READING_MAX_ID] = {

	[READING_FIRMWARE] = FIRMWARE_CHECK,

	[READING_MODULE] = MODULE_CHECK,

	[READING_MODULE_COMPRESSED] = MODULE_CHECK,

	[READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,

	[READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,

	[READING_POLICY] = POLICY_CHECK
@@ -917,7 +925,7 @@ static int ima_post_read_file(struct file *file, char *buf, loff_t size, 
	func = read_idmap[read_id] ?: FILE_CHECK;

	security_current_getlsmprop_subj(&prop);

	return process_measurement(file, current_cred(), &prop, buf, size,

				   MAY_READ, func);

				   MAY_READ, func, read_id);

}



/**

security/integrity/ima/ima_policy.c

+2 −1
Original line number Diff line number Diff line
@@ -244,7 +244,8 @@ static struct ima_rule_entry build_appraise_rules[] __ro_after_init = { 


static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {

	{.action = APPRAISE, .func = MODULE_CHECK,

	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},

	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED | IMA_MODSIG_ALLOWED |

		  IMA_CHECK_BLACKLIST},

	{.action = APPRAISE, .func = FIRMWARE_CHECK,

	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},

	{.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,

security/ipe/hooks.c

+1 −0
Original line number Diff line number Diff line
@@ -118,6 +118,7 @@ int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id, 
		op = IPE_OP_FIRMWARE;

		break;

	case READING_MODULE:

	case READING_MODULE_COMPRESSED:

		op = IPE_OP_KERNEL_MODULE;

		break;

	case READING_KEXEC_INITRAMFS: