On Wed, Dec 08, 2021 at 12:29:18PM +0100, Christian Brauner wrote:
> On Tue, Dec 07, 2021 at 03:21:12PM -0500, Stefan Berger wrote:
> > Implement an IMA namespace data structure that gets created alongside a
> > user namespace with CLONE_NEWUSER. This lays down the foundation for
> > namespacing the different aspects of IMA (eg. IMA-audit, IMA-measurement,
> > IMA-appraisal).
> >
> > Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
> > Suggested-by: James Bottomley <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>
> > ---
> > include/linux/ima.h | 59 +++++++++++++++++
> > include/linux/user_namespace.h | 4 ++
> > init/Kconfig | 10 +++
> > kernel/user.c | 9 ++-
> > kernel/user_namespace.c | 16 +++++
> > security/integrity/ima/Makefile | 3 +-
> > security/integrity/ima/ima.h | 4 ++
> > security/integrity/ima/ima_init.c | 4 ++
> > security/integrity/ima/ima_init_ima_ns.c | 32 +++++++++
> > security/integrity/ima/ima_ns.c | 82 ++++++++++++++++++++++++
> > 10 files changed, 221 insertions(+), 2 deletions(-)
> > create mode 100644 security/integrity/ima/ima_init_ima_ns.c
> > create mode 100644 security/integrity/ima/ima_ns.c
> >
> > diff --git a/include/linux/ima.h b/include/linux/ima.h
> > index b6ab66a546ae..86d126b9ff2f 100644
> > --- a/include/linux/ima.h
> > +++ b/include/linux/ima.h
> > @@ -11,6 +11,7 @@
> > #include <linux/fs.h>
> > #include <linux/security.h>
> > #include <linux/kexec.h>
> > +#include <linux/user_namespace.h>
> > #include <crypto/hash_info.h>
> > struct linux_binprm;
> >
> > @@ -210,6 +211,64 @@ static inline int ima_inode_removexattr(struct dentry *dentry,
> > }
> > #endif /* CONFIG_IMA_APPRAISE */
> >
> > +struct ima_namespace {
> > + struct kref kref;
> > + struct user_namespace *user_ns;
> > +};
> > +
> > +extern struct ima_namespace init_ima_ns;
> > +
> > +#ifdef CONFIG_IMA_NS
> > +
> > +void free_ima_ns(struct kref *kref);
> > +
> > +static inline struct ima_namespace *get_ima_ns(struct ima_namespace *ns)
> > +{
> > + if (ns)
> > + kref_get(&ns->kref);
> > +
> > + return ns;
> > +}
> > +
> > +static inline void put_ima_ns(struct ima_namespace *ns)
> > +{
> > + if (ns) {
> > + pr_debug("DEREF ima_ns: 0x%p ctr: %d\n", ns, kref_read(&ns->kref));
> > + kref_put(&ns->kref, free_ima_ns);
> > + }
> > +}
> > +
> > +struct ima_namespace *copy_ima_ns(struct ima_namespace *old_ns,
> > + struct user_namespace *user_ns);
> > +
> > +static inline struct ima_namespace *get_current_ns(void)
> > +{
> > + return current_user_ns()->ima_ns;
> > +}
> > +
> > +#else
> > +
> > +static inline struct ima_namespace *get_ima_ns(struct ima_namespace *ns)
> > +{
> > + return ns;
> > +}
> > +
> > +static inline void put_ima_ns(struct ima_namespace *ns)
> > +{
> > +}
> > +
> > +static inline struct ima_namespace *copy_ima_ns(struct ima_namespace *old_ns,
> > + struct user_namespace *user_ns)
> > +{
> > + return old_ns;
> > +}
> > +
> > +static inline struct ima_namespace *get_current_ns(void)
> > +{
> > + return &init_ima_ns;
> > +}
> > +#endif /* CONFIG_IMA_NS */
> > +
> > #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
> > extern bool ima_appraise_signature(enum kernel_read_file_id func);
> > #else
> > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
> > index 33a4240e6a6f..5249db04d62b 100644
> > --- a/include/linux/user_namespace.h
> > +++ b/include/linux/user_namespace.h
> > @@ -36,6 +36,7 @@ struct uid_gid_map { /* 64 bytes -- 1 cache line */
> > #define USERNS_INIT_FLAGS USERNS_SETGROUPS_ALLOWED
> >
> > struct ucounts;
> > +struct ima_namespace;
> >
> > enum ucount_type {
> > UCOUNT_USER_NAMESPACES,
> > @@ -99,6 +100,9 @@ struct user_namespace {
> > #endif
> > struct ucounts *ucounts;
> > long ucount_max[UCOUNT_COUNTS];
> > +#ifdef CONFIG_IMA
> > + struct ima_namespace *ima_ns;
> > +#endif
> > } __randomize_layout;
> >
> > struct ucounts {
> > diff --git a/init/Kconfig b/init/Kconfig
> > index 11f8a845f259..27890607e8cb 100644
> > --- a/init/Kconfig
> > +++ b/init/Kconfig
> > @@ -1242,6 +1242,16 @@ config NET_NS
> > Allow user space to create what appear to be multiple instances
> > of the network stack.
> >
> > +config IMA_NS
> > + bool "IMA namespace"
> > + depends on USER_NS
> > + depends on IMA
> > + default y
> > + help
> > + Allow the creation of IMA namespaces for each user namespace.
> > + Namespaced IMA enables having IMA features work separately
> > + in each IMA namespace.
> > +
> > endif # NAMESPACES
> >
> > config CHECKPOINT_RESTORE
> > diff --git a/kernel/user.c b/kernel/user.c
> > index e2cf8c22b539..b5dc803a033d 100644
> > --- a/kernel/user.c
> > +++ b/kernel/user.c
> > @@ -20,6 +20,10 @@
> > #include <linux/user_namespace.h>
> > #include <linux/proc_ns.h>
> >
> > +#ifdef CONFIG_IMA
> > +extern struct ima_namespace init_ima_ns;
> > +#endif
> > +
> > /*
> > * userns count is 1 for root user, 1 for init_uts_ns,
> > * and 1 for... ?
> > @@ -55,7 +59,7 @@ struct user_namespace init_user_ns = {
> > },
> > },
> > },
> > - .ns.count = REFCOUNT_INIT(3),
> > + .ns.count = REFCOUNT_INIT(4),
> > .owner = GLOBAL_ROOT_UID,
> > .group = GLOBAL_ROOT_GID,
> > .ns.inum = PROC_USER_INIT_INO,
> > @@ -67,6 +71,9 @@ struct user_namespace init_user_ns = {
> > .keyring_name_list = LIST_HEAD_INIT(init_user_ns.keyring_name_list),
> > .keyring_sem = __RWSEM_INITIALIZER(init_user_ns.keyring_sem),
> > #endif
> > +#ifdef CONFIG_IMA
> > + .ima_ns = &init_ima_ns,
> > +#endif
> > };
> > EXPORT_SYMBOL_GPL(init_user_ns);
> >
> > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
> > index 6b2e3ca7ee99..c26885343b19 100644
> > --- a/kernel/user_namespace.c
> > +++ b/kernel/user_namespace.c
> > @@ -20,6 +20,7 @@
> > #include <linux/fs_struct.h>
> > #include <linux/bsearch.h>
> > #include <linux/sort.h>
> > +#include <linux/ima.h>
> >
> > static struct kmem_cache *user_ns_cachep __read_mostly;
> > static DEFINE_MUTEX(userns_state_mutex);
> > @@ -141,8 +142,20 @@ int create_user_ns(struct cred *new)
> > if (!setup_userns_sysctls(ns))
> > goto fail_keyring;
> >
> > +#if CONFIG_IMA
> > + ns->ima_ns = copy_ima_ns(parent_ns->ima_ns, ns);
> > + if (IS_ERR(ns->ima_ns)) {
> > + ret = PTR_ERR(ns->ima_ns);
> > + goto fail_userns_sysctls;
> > + }
> > +#endif
> > +
> > set_cred_user_ns(new, ns);
> > return 0;
> > +#if CONFIG_IMA
> > +fail_userns_sysctls:
> > + retire_userns_sysctls(ns);
> > +#endif
If you rewrite copy_ima_ns() put_ima_ns() a little you can remove all
the ifdefs in here and make this patch tiny.
Make copy_ima_ns() return an int. Afaict, you can remove passing the
parent ima_ns completely but if you have to pass through the
parent_userns.
Then you can initialize new_userns->ima_ns inside of copy_ima_ns() and
the ifdef will only need to be visible inside copy_ima_ns() and not in
create_user_ns(). Similar put_ima_ns() is only called in a single place
namely kernel/user_namespace.c. Make it take a user_namespace argument
and you can remove the ifdef in __put_user_ns() for put_ima_ns() too.
So something -- COMPLETELY UNTESTED -- like the below should work:
diff --git a/include/linux/ima.h b/include/linux/ima.h
index a8017272d78d..dc4aa3027bf4 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -310,16 +310,17 @@ static inline struct ima_namespace *get_ima_ns(struct ima_namespace *ns)
return ns;
}
-static inline void put_ima_ns(struct ima_namespace *ns)
+static inline void put_ima_ns(struct user_namespace *ns)
{
- if (ns) {
- pr_debug("DEREF ima_ns: 0x%p ctr: %d\n", ns, kref_read(&ns->kref));
- kref_put(&ns->kref, free_ima_ns);
+ struct ima_namespace *ima_ns = ns->ima_ns;
+
+ if (im_ns) {
+ pr_debug("DEREF ima_ns: 0x%p ctr: %d\n", im_ns, kref_read(&im_ns->kref));
+ kref_put(&im_ns->kref, free_ima_ns);
}
}
-struct ima_namespace *copy_ima_ns(struct ima_namespace *old_ns,
- struct user_namespace *user_ns);
+int copy_ima_ns(struct user_namespace *user_ns);
static inline struct ima_namespace *get_current_ns(void)
{
@@ -333,14 +334,13 @@ static inline struct ima_namespace *get_ima_ns(struct ima_namespace *ns)
return ns;
}
-static inline void put_ima_ns(struct ima_namespace *ns)
+static inline void put_ima_ns(struct user_namespace *ns)
{
}
-static inline struct ima_namespace *copy_ima_ns(struct ima_namespace *old_ns,
- struct user_namespace *user_ns)
+static inline int copy_ima_ns(struct user_namespace *user_ns)
{
- return old_ns;
+ return 0;
}
static inline struct ima_namespace *get_current_ns(void)
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index c26885343b19..794f027e7677 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -138,24 +138,19 @@ int create_user_ns(struct cred *new)
INIT_LIST_HEAD(&ns->keyring_name_list);
init_rwsem(&ns->keyring_sem);
#endif
+
ret = -ENOMEM;
if (!setup_userns_sysctls(ns))
goto fail_keyring;
-#if CONFIG_IMA
- ns->ima_ns = copy_ima_ns(parent_ns->ima_ns, ns);
- if (IS_ERR(ns->ima_ns)) {
- ret = PTR_ERR(ns->ima_ns);
- goto fail_userns_sysctls;
- }
-#endif
+ ret = create_ima_ns(ns);
+ if (ret)
+ goto fail_sysctls;
set_cred_user_ns(new, ns);
return 0;
-#if CONFIG_IMA
-fail_userns_sysctls:
+fail_sysctls:
retire_userns_sysctls(ns);
-#endif
fail_keyring:
#ifdef CONFIG_PERSISTENT_KEYRINGS
key_put(ns->persistent_keyring_register);
@@ -209,9 +204,7 @@ static void free_user_ns(struct work_struct *work)
kfree(ns->projid_map.forward);
kfree(ns->projid_map.reverse);
}
-#ifdef CONFIG_IMA
- put_ima_ns(ns->ima_ns);
-#endif
+ put_ima_ns(ns);
retire_userns_sysctls(ns);
key_free_user_ns(ns);
ns_free_inum(&ns->ns);
diff --git a/security/integrity/ima/ima_ns.c b/security/integrity/ima/ima_ns.c
index debe863364fd..2bae2c0cdce1 100644
--- a/security/integrity/ima/ima_ns.c
+++ b/security/integrity/ima/ima_ns.c
@@ -21,14 +21,14 @@
static struct kmem_cache *imans_cachep;
-static struct ima_namespace *create_ima_ns(struct user_namespace *user_ns)
+static int create_ima_ns(struct user_namespace *user_ns)
{
struct ima_namespace *ns;
int err;
ns = kmem_cache_zalloc(imans_cachep, GFP_KERNEL);
if (!ns)
- return ERR_PTR(-ENOMEM);
+ return -ENOMEM;
pr_debug("NEW ima_ns: 0x%p\n", ns);
kref_init(&ns->kref);
@@ -44,12 +44,13 @@ static struct ima_namespace *create_ima_ns(struct user_namespace *user_ns)
INIT_LIST_HEAD(&ns->ima_keys);
#endif
- return ns;
+ user_ns->ima_ns = user_ns;
+ return 0;
fail_free:
kmem_cache_free(imans_cachep, ns);
- return ERR_PTR(err);
+ return err;
}
/**
@@ -58,8 +59,7 @@ static struct ima_namespace *create_ima_ns(struct user_namespace *user_ns)
* @old_ns: old ima namespace to clone
* @user_ns: User namespace
*/
-struct ima_namespace *copy_ima_ns(struct ima_namespace *old_ns,
- struct user_namespace *user_ns)
+int copy_ima_ns(struct user_namespace *user_ns)
{
return create_ima_ns(user_ns);
}
