Re: [PATCH RFC v11 9/19] ipe: add permissive toggle

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 10/23/2023 8:52 PM, Paul Moore wrote:
On Oct  4, 2023 Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx> wrote:

IPE, like SELinux, supports a permissive mode. This mode allows policy
authors to test and evaluate IPE policy without it effecting their
programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
be reported.

This patch adds the following audit records:

     audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295
       ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
     audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295
       ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1

The audit record only emit when the value from the user input is
different from the current enforce value.

Signed-off-by: Deven Bowers <deven.desai@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx>
---
v2:
   + Split evaluation loop, access control hooks,
     and evaluation loop from policy parser and userspace
     interface to pass mailing list character limit

v3:
   + Move ipe_load_properties to patch 04.
   + Remove useless 0-initializations
   + Prefix extern variables with ipe_
   + Remove kernel module parameters, as these are
     exposed through sysctls.
   + Add more prose to the IPE base config option
     help text.
   + Use GFP_KERNEL for audit_log_start.
   + Remove unnecessary caching system.
   + Remove comments from headers
   + Use rcu_access_pointer for rcu-pointer null check
   + Remove usage of reqprot; use prot only.
   + Move policy load and activation audit event to 03/12

v4:
   + Remove sysctls in favor of securityfs nodes
   + Re-add kernel module parameters, as these are now
     exposed through securityfs.
   + Refactor property audit loop to a separate function.

v5:
   + fix minor grammatical errors
   + do not group rule by curly-brace in audit record,
     reconstruct the exact rule.

v6:
   + No changes

v7:
   + Further split lsm creation into a separate commit from the
     evaluation loop and audit system, for easier review.
   + Propagating changes to support the new ipe_context structure in the
     evaluation loop.
   + Split out permissive functionality into a separate patch for easier
     review.
   + Remove permissive switch compile-time configuration option - this
     is trivial to add later.

v8:
   + Remove "IPE" prefix from permissive audit record
   + align fields to the linux-audit field dictionary. This causes the
     following fields to change:
       enforce -> permissive

   + Remove duplicated information correlated with syscall record, that
     will always be present in the audit event.
   + Change audit types:
     + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
       + There is no significant difference in meaning between
         these types.

v9:
   + Clean up ipe_context related code

v10:
   + Change audit format to comform with the existing format selinux is
     using
   + Remove the audit record emission during init to align with selinux,
     which does not perform this action.

v11:
   + Remove redundant code
---
  security/ipe/audit.c | 22 ++++++++++++++
  security/ipe/audit.h |  1 +
  security/ipe/eval.c  | 14 +++++++--
  security/ipe/eval.h  |  1 +
  security/ipe/fs.c    | 68 ++++++++++++++++++++++++++++++++++++++++++++
  5 files changed, 104 insertions(+), 2 deletions(-)

...

diff --git a/security/ipe/eval.c b/security/ipe/eval.c
index 499b6b3338f2..78c54ff1fdd3 100644
--- a/security/ipe/eval.c
+++ b/security/ipe/eval.c
@@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
  	ipe_audit_match(ctx, match_type, action, rule);
if (action == IPE_ACTION_DENY)
-		return -EACCES;
+		rc = -EACCES;
+
+	if (!enforcing)
+		rc = 0;

Why the local @enforcing variable?  Why not:

   if (!READ_ONCE(enforce))
     rc = 0;


Yes the variable is unnecessary, I will remove it.
-Fan
-	return 0;
+	return rc;
  }
/**
@@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb)
module_param(success_audit, bool, 0400);
  MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
+module_param(enforce, bool, 0400);
+MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");

"enforcing"

--
paul-moore.com



[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux