lkml.org 
[lkml]   [2023]   [Oct]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH RFC v11 9/19] ipe: add permissive toggle
    On Oct  4, 2023 Fan Wu <wufan@linux.microsoft.com> wrote:
    >
    > IPE, like SELinux, supports a permissive mode. This mode allows policy
    > authors to test and evaluate IPE policy without it effecting their
    > programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
    > be reported.
    >
    > This patch adds the following audit records:
    >
    > audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295
    > ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
    > audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295
    > ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
    >
    > The audit record only emit when the value from the user input is
    > different from the current enforce value.
    >
    > Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
    > Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
    > ---
    > v2:
    > + Split evaluation loop, access control hooks,
    > and evaluation loop from policy parser and userspace
    > interface to pass mailing list character limit
    >
    > v3:
    > + Move ipe_load_properties to patch 04.
    > + Remove useless 0-initializations
    > + Prefix extern variables with ipe_
    > + Remove kernel module parameters, as these are
    > exposed through sysctls.
    > + Add more prose to the IPE base config option
    > help text.
    > + Use GFP_KERNEL for audit_log_start.
    > + Remove unnecessary caching system.
    > + Remove comments from headers
    > + Use rcu_access_pointer for rcu-pointer null check
    > + Remove usage of reqprot; use prot only.
    > + Move policy load and activation audit event to 03/12
    >
    > v4:
    > + Remove sysctls in favor of securityfs nodes
    > + Re-add kernel module parameters, as these are now
    > exposed through securityfs.
    > + Refactor property audit loop to a separate function.
    >
    > v5:
    > + fix minor grammatical errors
    > + do not group rule by curly-brace in audit record,
    > reconstruct the exact rule.
    >
    > v6:
    > + No changes
    >
    > v7:
    > + Further split lsm creation into a separate commit from the
    > evaluation loop and audit system, for easier review.
    > + Propagating changes to support the new ipe_context structure in the
    > evaluation loop.
    > + Split out permissive functionality into a separate patch for easier
    > review.
    > + Remove permissive switch compile-time configuration option - this
    > is trivial to add later.
    >
    > v8:
    > + Remove "IPE" prefix from permissive audit record
    > + align fields to the linux-audit field dictionary. This causes the
    > following fields to change:
    > enforce -> permissive
    >
    > + Remove duplicated information correlated with syscall record, that
    > will always be present in the audit event.
    > + Change audit types:
    > + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
    > + There is no significant difference in meaning between
    > these types.
    >
    > v9:
    > + Clean up ipe_context related code
    >
    > v10:
    > + Change audit format to comform with the existing format selinux is
    > using
    > + Remove the audit record emission during init to align with selinux,
    > which does not perform this action.
    >
    > v11:
    > + Remove redundant code
    > ---
    > security/ipe/audit.c | 22 ++++++++++++++
    > security/ipe/audit.h | 1 +
    > security/ipe/eval.c | 14 +++++++--
    > security/ipe/eval.h | 1 +
    > security/ipe/fs.c | 68 ++++++++++++++++++++++++++++++++++++++++++++
    > 5 files changed, 104 insertions(+), 2 deletions(-)

    ...

    > diff --git a/security/ipe/eval.c b/security/ipe/eval.c
    > index 499b6b3338f2..78c54ff1fdd3 100644
    > --- a/security/ipe/eval.c
    > +++ b/security/ipe/eval.c
    > @@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
    > ipe_audit_match(ctx, match_type, action, rule);
    >
    > if (action == IPE_ACTION_DENY)
    > - return -EACCES;
    > + rc = -EACCES;
    > +
    > + if (!enforcing)
    > + rc = 0;

    Why the local @enforcing variable? Why not:

    if (!READ_ONCE(enforce))
    rc = 0;

    > - return 0;
    > + return rc;
    > }
    >
    > /**
    > @@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb)
    >
    > module_param(success_audit, bool, 0400);
    > MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
    > +module_param(enforce, bool, 0400);
    > +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");

    "enforcing"

    --
    paul-moore.com
    \
     
     \ /
      Last update: 2023-10-24 05:53    [W:5.001 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site