Re: [PATCH v9 7/8] ima: check against blacklisted hashes for files with modsig

2019-10-25 Thread Nayna Jain 



On 10/24/19 12:48 PM, Lakshmi Ramasubramanian wrote:

On 10/23/2019 8:47 PM, Nayna Jain wrote:


+/*
+ * ima_check_blacklist - determine if the binary is blacklisted.
+ *
+ * Add the hash of the blacklisted binary to the measurement list, 
based

+ * on policy.
+ *
+ * Returns -EPERM if the hash is blacklisted.
+ */
+int ima_check_blacklist(struct integrity_iint_cache *iint,
+    const struct modsig *modsig, int pcr)
+{
+    enum hash_algo hash_algo;
+    const u8 *digest = NULL;
+    u32 digestsize = 0;
+    int rc = 0;
+
+    if (!(iint->flags & IMA_CHECK_BLACKLIST))
+    return 0;
+
+    if (iint->flags & IMA_MODSIG_ALLOWED && modsig) {
+    ima_get_modsig_digest(modsig, _algo, , 
);

+
+    rc = is_binary_blacklisted(digest, digestsize);
+    if ((rc == -EPERM) && (iint->flags & IMA_MEASURE))
+    process_buffer_measurement(digest, digestsize,
+   "blacklisted-hash", NONE,
+   pcr);
+    }


The enum value "NONE" is being passed to process_buffer_measurement to 
indicate that the check for required action based on ima policy is 
already done by ima_check_blacklist. Not sure, but this can cause 
confusion in the future when someone updates process_buffer_measurement.



As I explained in the response to other patch, the purpose is to 
indicate that it is an auxiliary measurement record. By passing func as 
NONE, it implies there is no explicit policy to be queried for the 
template as it is an additional record for an existing policy and is to 
use ima-buf template.


What type of confusion do you mean ?

Thanks & Regards,

 - Nayna

Re: [PATCH v9 7/8] ima: check against blacklisted hashes for files with modsig

2019-10-24 Thread Lakshmi Ramasubramanian 

On 10/23/2019 8:47 PM, Nayna Jain wrote:


+/*
+ * ima_check_blacklist - determine if the binary is blacklisted.
+ *
+ * Add the hash of the blacklisted binary to the measurement list, based
+ * on policy.
+ *
+ * Returns -EPERM if the hash is blacklisted.
+ */
+int ima_check_blacklist(struct integrity_iint_cache *iint,
+   const struct modsig *modsig, int pcr)
+{
+   enum hash_algo hash_algo;
+   const u8 *digest = NULL;
+   u32 digestsize = 0;
+   int rc = 0;
+
+   if (!(iint->flags & IMA_CHECK_BLACKLIST))
+   return 0;
+
+   if (iint->flags & IMA_MODSIG_ALLOWED && modsig) {
+   ima_get_modsig_digest(modsig, _algo, , );
+
+   rc = is_binary_blacklisted(digest, digestsize);
+   if ((rc == -EPERM) && (iint->flags & IMA_MEASURE))
+   process_buffer_measurement(digest, digestsize,
+  "blacklisted-hash", NONE,
+  pcr);
+   }


The enum value "NONE" is being passed to process_buffer_measurement to 
indicate that the check for required action based on ima policy is 
already done by ima_check_blacklist. Not sure, but this can cause 
confusion in the future when someone updates process_buffer_measurement.


Would it instead be better to add another parameter to 
process_buffer_measurement to indicate the above condition?


 -lakshmi

[PATCH v9 7/8] ima: check against blacklisted hashes for files with modsig

2019-10-23 Thread Nayna Jain 
Asymmetric private keys are used to sign multiple files. The kernel
currently support checking against blacklisted keys. However, if the
public key is blacklisted, any file signed by the blacklisted key will
automatically fail signature verification. We might not want to blacklist
all the files signed by a particular key, but just a single file.
Blacklisting the public key is not fine enough granularity.

This patch adds support for checking against the blacklisted hash of the
file based on the IMA policy. The blacklisted hash is the file hash
without the appended signature. Defined is a new policy option
"appraise_flag=check_blacklist".

In addition to the blacklisted binary hashes stored in the firmware "dbx"
variable, the Linux kernel may be configured to load blacklisted binary
hashes onto the .blacklist keyring as well.  The following example shows
how to blacklist a kernel module.

$ sha256sum kernel/kheaders.ko
77fa889b35a05338ec52e51591c1b89d4c8d1c99a21251d7c22b1a8642a6bad3  kern
el/kheaders.ko

$ grep BLACKLIST .config
# CONFIG_IMA_BLACKLIST_KEYRING is not set
CONFIG_SYSTEM_BLACKLIST_KEYRING=y
CONFIG_SYSTEM_BLACKLIST_HASH_LIST="blacklist-hash-list"

$ cat certs/blacklist-hash-list
"bin:77fa889b35a05338ec52e51591c1b89d4c8d1c99a21251d7c22b1a8642a6bad3"

Update the IMA custom measurement and appraisal policy rules
(/etc/ima-policy):

measure func=MODULE_CHECK template=ima-modsig
appraise func=MODULE_CHECK appraise_flag=check_blacklist
appraise_type=imasig|modsig

After building, installing, and rebooting the kernel:

# keyctl show %keyring:.blacklist | grep 77fa889b35a05
 545660333 ---lswrv  0 0   \_ blacklist:
bin:77fa889b35a05338ec52e51591c1b89d4c8d1c99a21251d7c22b1a8642a6bad3

# cat /sys/kernel/security/ima/policy | grep MODULE_CHECK
measure func=MODULE_CHECK template=ima-modsig
appraise func=MODULE_CHECK appraise_flag=check_blacklist
appraise_type=imasig|modsig

# modprobe kheaders
modprobe: ERROR: could not insert 'kheaders': Permission denied

# cat /sys/kernel/security/ima/ascii_runtime_measurements
10 0c9834db5a0182c1fb0cdc5d3adcf11a11fd83dd ima-sig
sha256:3bc6ed4f0b4d6e31bc1dbc9ef844605abc7afdc6d81a57d77a1ec9407997c40
2 /usr/lib/modules/5.4.0-rc3+/kernel/kernel/kheaders.ko

10 82aad2bcc3fa8ed94762356b5c14838f3bcfa6a0 ima-modsig
sha256:3bc6ed4f0b4d6e31bc1dbc9ef844605abc7afdc6d81a57d77a1ec9407997c40
2 /usr/lib/modules/5.4.0rc3+/kernel/kernel/kheaders.ko  sha256:77fa889b3
5a05338ec52e51591c1b89d4c8d1c99a21251d7c22b1a8642a6bad3
3082029a06092a864886f70d010702a082028b30820287020101310d300b0609608648
016503040201300b06092a864886f70d01070131820264

10 25b72217cc1152b44b134ce2cd68f12dfb71acb3 ima-buf
sha256:8b58427fedcf8f4b20bc8dc007f2e232bf7285d7b93a66476321f9c2a3aa132
b blacklisted-hash
77fa889b35a05338ec52e51591c1b89d4c8d1c99a21251d7c22b1a8642a6bad3

Signed-off-by: Nayna Jain 
---
 Documentation/ABI/testing/ima_policy  |  4 
 security/integrity/ima/ima.h  |  8 +++
 security/integrity/ima/ima_appraise.c | 33 +++
 security/integrity/ima/ima_main.c | 12 ++
 security/integrity/ima/ima_policy.c   | 12 --
 security/integrity/integrity.h|  1 +
 6 files changed, 64 insertions(+), 6 deletions(-)

diff --git a/Documentation/ABI/testing/ima_policy 
b/Documentation/ABI/testing/ima_policy
index 29ebe9afdac4..29aaedf33246 100644
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -25,6 +25,7 @@ Description:
lsm:[[subj_user=] [subj_role=] [subj_type=]
 [obj_user=] [obj_role=] [obj_type=]]
option: [[appraise_type=]] [template=] [permit_directio]
+   [appraise_flag=]
base:   func:= 
[BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]
[FIRMWARE_CHECK]
[KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
@@ -38,6 +39,9 @@ Description:
fowner:= decimal value
lsm:are LSM specific
option: appraise_type:= [imasig] [imasig|modsig]
+   appraise_flag:= [check_blacklist]
+   Currently, blacklist check is only for files signed 
with appended
+   signature.
template:= name of a defined IMA template type
(eg, ima-ng). Only valid when action is "measure".
pcr:= decimal value
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index a65772ffa427..df4ca482fb53 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -256,6 +256,8 @@ int ima_policy_show(struct seq_file *m, void *v);
 #define IMA_APPRAISE_KEXEC 0x40
 
 #ifdef CONFIG_IMA_APPRAISE
+int ima_check_blacklist(struct integrity_iint_cache *iint,
+   const struct modsig *modsig, int pcr);
 int