On Oct 4, 2023 Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx> wrote:
>
> IPE, like SELinux, supports a permissive mode. This mode allows policy
> authors to test and evaluate IPE policy without it effecting their
> programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
> be reported.
>
> This patch adds the following audit records:
>
> audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295
> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
> audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295
> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
>
> The audit record only emit when the value from the user input is
> different from the current enforce value.
>
> Signed-off-by: Deven Bowers <deven.desai@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx>
> ---
> v2:
> + Split evaluation loop, access control hooks,
> and evaluation loop from policy parser and userspace
> interface to pass mailing list character limit
>
> v3:
> + Move ipe_load_properties to patch 04.
> + Remove useless 0-initializations
> + Prefix extern variables with ipe_
> + Remove kernel module parameters, as these are
> exposed through sysctls.
> + Add more prose to the IPE base config option
> help text.
> + Use GFP_KERNEL for audit_log_start.
> + Remove unnecessary caching system.
> + Remove comments from headers
> + Use rcu_access_pointer for rcu-pointer null check
> + Remove usage of reqprot; use prot only.
> + Move policy load and activation audit event to 03/12
>
> v4:
> + Remove sysctls in favor of securityfs nodes
> + Re-add kernel module parameters, as these are now
> exposed through securityfs.
> + Refactor property audit loop to a separate function.
>
> v5:
> + fix minor grammatical errors
> + do not group rule by curly-brace in audit record,
> reconstruct the exact rule.
>
> v6:
> + No changes
>
> v7:
> + Further split lsm creation into a separate commit from the
> evaluation loop and audit system, for easier review.
> + Propagating changes to support the new ipe_context structure in the
> evaluation loop.
> + Split out permissive functionality into a separate patch for easier
> review.
> + Remove permissive switch compile-time configuration option - this
> is trivial to add later.
>
> v8:
> + Remove "IPE" prefix from permissive audit record
> + align fields to the linux-audit field dictionary. This causes the
> following fields to change:
> enforce -> permissive
>
> + Remove duplicated information correlated with syscall record, that
> will always be present in the audit event.
> + Change audit types:
> + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
> + There is no significant difference in meaning between
> these types.
>
> v9:
> + Clean up ipe_context related code
>
> v10:
> + Change audit format to comform with the existing format selinux is
> using
> + Remove the audit record emission during init to align with selinux,
> which does not perform this action.
>
> v11:
> + Remove redundant code
> ---
> security/ipe/audit.c | 22 ++++++++++++++
> security/ipe/audit.h | 1 +
> security/ipe/eval.c | 14 +++++++--
> security/ipe/eval.h | 1 +
> security/ipe/fs.c | 68 ++++++++++++++++++++++++++++++++++++++++++++
> 5 files changed, 104 insertions(+), 2 deletions(-)
...
> diff --git a/security/ipe/eval.c b/security/ipe/eval.c
> index 499b6b3338f2..78c54ff1fdd3 100644
> --- a/security/ipe/eval.c
> +++ b/security/ipe/eval.c
> @@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
> ipe_audit_match(ctx, match_type, action, rule);
>
> if (action == IPE_ACTION_DENY)
> - return -EACCES;
> + rc = -EACCES;
> +
> + if (!enforcing)
> + rc = 0;
Why the local @enforcing variable? Why not:
if (!READ_ONCE(enforce))
rc = 0;
> - return 0;
> + return rc;
> }
>
> /**
> @@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb)
>
> module_param(success_audit, bool, 0400);
> MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
> +module_param(enforce, bool, 0400);
> +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");
"enforcing"
--
paul-moore.com
