ima: Access decompressed kernel module to verify appended signature

Currently, when in-kernel module decompression (CONFIG_MODULE_DECOMPRESS)
is enabled, IMA has no way to verify the appended module signature as it
can't decompress the module.

Define a new kernel_read_file_id enumerate READING_MODULE_COMPRESSED so
IMA can calculate the compressed kernel module data hash on
READING_MODULE_COMPRESSED and defer appraising/measuring it until on
READING_MODULE when the module has been decompressed.

Before enabling in-kernel module decompression, a kernel module in
initramfs can still be loaded with ima_policy=secure_boot. So adjust the
kernel module rule in secure_boot policy to allow either an IMA
signature OR an appended signature i.e. to use
"appraise func=MODULE_CHECK appraise_type=imasig|modsig".

Reported-by: Karel Srot <ksrot@redhat.com>
Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/include/linux/kernel_read_file.h b/include/linux/kernel_read_file.h
index 90451e2e12bd19eeb436ad59ad83d7ab1168e26b..d613a7b4dd35ad261596863041f77227a29d69ea 100644 (file)
--- a/include/linux/kernel_read_file.h
+++ b/include/linux/kernel_read_file.h
@@ -14,6 +14,7 @@
        id(KEXEC_INITRAMFS, kexec-initramfs)    \
        id(POLICY, security-policy)             \
        id(X509_CERTIFICATE, x509-certificate)  \
+       id(MODULE_COMPRESSED, kernel-module-compressed) \
        id(MAX_ID, )
 
 #define __fid_enumify(ENUM, dummy) READING_ ## ENUM,

diff --git a/kernel/module/main.c b/kernel/module/main.c
index c66b261849362abb58cd9c52a59cc95ac44ed0c5..7b3ec2fa6e7c096237434943526192407a5debf8 100644 (file)
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -3675,24 +3675,35 @@ static int idempotent_wait_for_completion(struct idempotent *u)
 
 static int init_module_from_file(struct file *f, const char __user * uargs, int flags)
 {
+       bool compressed = !!(flags & MODULE_INIT_COMPRESSED_FILE);
        struct load_info info = { };
        void *buf = NULL;
        int len;
+       int err;
 
-       len = kernel_read_file(f, 0, &buf, INT_MAX, NULL, READING_MODULE);
+       len = kernel_read_file(f, 0, &buf, INT_MAX, NULL,
+                              compressed ? READING_MODULE_COMPRESSED :
+                                           READING_MODULE);
        if (len < 0) {
                mod_stat_inc(&failed_kreads);
                return len;
        }
 
-       if (flags & MODULE_INIT_COMPRESSED_FILE) {
-               int err = module_decompress(&info, buf, len);
+       if (compressed) {
+               err = module_decompress(&info, buf, len);
                vfree(buf); /* compressed data is no longer needed */
                if (err) {
                        mod_stat_inc(&failed_decompress);
                        mod_stat_add_long(len, &invalid_decompress_bytes);
                        return err;
                }
+               err = security_kernel_post_read_file(f, (char *)info.hdr, info.len,
+                                                    READING_MODULE);
+               if (err) {
+                       mod_stat_inc(&failed_kreads);
+                       free_copy(&info, flags);
+                       return err;
+               }
        } else {
                info.hdr = buf;
                info.len = len;

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index ebaebccfbe9ab134a059fcda5a0a3cc001e9d073..edd0fd3d77a0e5de9fe936ca326ff62df6c1135c 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -235,7 +235,8 @@ static void ima_file_free(struct file *file)
 
 static int process_measurement(struct file *file, const struct cred *cred,
                               struct lsm_prop *prop, char *buf, loff_t size,
-                              int mask, enum ima_hooks func)
+                              int mask, enum ima_hooks func,
+                              enum kernel_read_file_id read_id)
 {
        struct inode *real_inode, *inode = file_inode(file);
        struct ima_iint_cache *iint = NULL;
@@ -406,6 +407,12 @@ static int process_measurement(struct file *file, const struct cred *cred,
        if (rc != 0 && rc != -EBADF && rc != -EINVAL)
                goto out_locked;
 
+       /* Defer measuring/appraising kernel modules to READING_MODULE */
+       if (read_id == READING_MODULE_COMPRESSED) {
+               must_appraise = 0;
+               goto out_locked;
+       }
+
        if (!pathbuf)   /* ima_rdwr_violation possibly pre-fetched */
                pathname = ima_d_path(&file->f_path, &pathbuf, filename);
 
@@ -486,14 +493,14 @@ static int ima_file_mmap(struct file *file, unsigned long reqprot,
 
        if (reqprot & PROT_EXEC) {
                ret = process_measurement(file, current_cred(), &prop, NULL,
-                                         0, MAY_EXEC, MMAP_CHECK_REQPROT);
+                                         0, MAY_EXEC, MMAP_CHECK_REQPROT, 0);
                if (ret)
                        return ret;
        }
 
        if (prot & PROT_EXEC)
                return process_measurement(file, current_cred(), &prop, NULL,
-                                          0, MAY_EXEC, MMAP_CHECK);
+                                          0, MAY_EXEC, MMAP_CHECK, 0);
 
        return 0;
 }
@@ -577,7 +584,7 @@ static int ima_bprm_check(struct linux_binprm *bprm)
 
        security_current_getlsmprop_subj(&prop);
        return process_measurement(bprm->file, current_cred(),
-                                  &prop, NULL, 0, MAY_EXEC, BPRM_CHECK);
+                                  &prop, NULL, 0, MAY_EXEC, BPRM_CHECK, 0);
 }
 
 /**
@@ -607,7 +614,7 @@ static int ima_creds_check(struct linux_binprm *bprm, const struct file *file)
 
        security_current_getlsmprop_subj(&prop);
        return process_measurement((struct file *)file, bprm->cred, &prop, NULL,
-                                  0, MAY_EXEC, CREDS_CHECK);
+                                  0, MAY_EXEC, CREDS_CHECK, 0);
 }
 
 /**
@@ -655,7 +662,7 @@ static int ima_file_check(struct file *file, int mask)
        security_current_getlsmprop_subj(&prop);
        return process_measurement(file, current_cred(), &prop, NULL, 0,
                                   mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
-                                          MAY_APPEND), FILE_CHECK);
+                                          MAY_APPEND), FILE_CHECK, 0);
 }
 
 static int __ima_inode_hash(struct inode *inode, struct file *file, char *buf,
@@ -874,12 +881,13 @@ static int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
        func = read_idmap[read_id] ?: FILE_CHECK;
        security_current_getlsmprop_subj(&prop);
        return process_measurement(file, current_cred(), &prop, NULL, 0,
-                                  MAY_READ, func);
+                                  MAY_READ, func, 0);
 }
 
 const int read_idmap[READING_MAX_ID] = {
        [READING_FIRMWARE] = FIRMWARE_CHECK,
        [READING_MODULE] = MODULE_CHECK,
+       [READING_MODULE_COMPRESSED] = MODULE_CHECK,
        [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
        [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,
        [READING_POLICY] = POLICY_CHECK
@@ -917,7 +925,7 @@ static int ima_post_read_file(struct file *file, char *buf, loff_t size,
        func = read_idmap[read_id] ?: FILE_CHECK;
        security_current_getlsmprop_subj(&prop);
        return process_measurement(file, current_cred(), &prop, buf, size,
-                                  MAY_READ, func);
+                                  MAY_READ, func, read_id);
 }
 
 /**

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 164d62832f8ec116dc2643cfb5af5672f1ca3c6f..7468afaab68654cf8dcf96d7677d3a3475486fb5 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -244,7 +244,8 @@ static struct ima_rule_entry build_appraise_rules[] __ro_after_init = {
 
 static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
        {.action = APPRAISE, .func = MODULE_CHECK,
-        .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
+        .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED | IMA_MODSIG_ALLOWED |
+                 IMA_CHECK_BLACKLIST},
        {.action = APPRAISE, .func = FIRMWARE_CHECK,
         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
        {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,

diff --git a/security/ipe/hooks.c b/security/ipe/hooks.c
index d0323b81cd8f95de47901071a0cfe8fc4c027e2c..1053a4acf5898fe43cf412c8b1eac6e7bf42e9d1 100644 (file)
--- a/security/ipe/hooks.c
+++ b/security/ipe/hooks.c
@@ -118,6 +118,7 @@ int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id,
                op = IPE_OP_FIRMWARE;
                break;
        case READING_MODULE:
+       case READING_MODULE_COMPRESSED:
                op = IPE_OP_KERNEL_MODULE;
                break;
        case READING_KEXEC_INITRAMFS:

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index dfc22da42f307d00ac6a477b833fbdf8bb54e228..c1ff69d5d76e3b43cd72ca970efda00fd99d4086 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4275,7 +4275,7 @@ static int selinux_kernel_read_file(struct file *file,
 {
        int rc = 0;
 
-       BUILD_BUG_ON_MSG(READING_MAX_ID > 7,
+       BUILD_BUG_ON_MSG(READING_MAX_ID > 8,
                         "New kernel_read_file_id introduced; update SELinux!");
 
        switch (id) {
@@ -4283,6 +4283,7 @@ static int selinux_kernel_read_file(struct file *file,
                rc = selinux_kernel_load_from_file(file, SYSTEM__FIRMWARE_LOAD);
                break;
        case READING_MODULE:
+       case READING_MODULE_COMPRESSED:
                rc = selinux_kernel_load_from_file(file, SYSTEM__MODULE_LOAD);
                break;
        case READING_KEXEC_IMAGE:
@@ -4311,7 +4312,7 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
 {
        int rc = 0;
 
-       BUILD_BUG_ON_MSG(LOADING_MAX_ID > 7,
+       BUILD_BUG_ON_MSG(LOADING_MAX_ID > 8,
                         "New kernel_load_data_id introduced; update SELinux!");
 
        switch (id) {