From a68916eaedcd01f254ac4c09ca12b5065d710fd0 Mon Sep 17 00:00:00 2001 From: Deven Bowers Date: Fri, 2 Aug 2024 23:08:24 -0700 Subject: [PATCH] ipe: add permissive toggle IPE, like SELinux, supports a permissive mode. This mode allows policy authors to test and evaluate IPE policy without it affecting their programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS will be reported. This patch adds the following audit records: audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 The audit record only emit when the value from the user input is different from the current enforce value. Signed-off-by: Deven Bowers Signed-off-by: Fan Wu Signed-off-by: Paul Moore --- security/ipe/audit.c | 27 ++++++++++++++++-- security/ipe/audit.h | 1 + security/ipe/eval.c | 11 ++++++-- security/ipe/eval.h | 1 + security/ipe/fs.c | 66 ++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 102 insertions(+), 4 deletions(-) diff --git a/security/ipe/audit.c b/security/ipe/audit.c index 5a859f88cfb4..5af150d99d63 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -97,8 +97,8 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx, if (!ab) return; - audit_log_format(ab, "ipe_op=%s ipe_hook=%s pid=%d comm=", - op, audit_hook_names[ctx->hook], + audit_log_format(ab, "ipe_op=%s ipe_hook=%s enforcing=%d pid=%d comm=", + op, audit_hook_names[ctx->hook], READ_ONCE(enforce), task_tgid_nr(current)); audit_log_untrustedstring(ab, get_task_comm(comm, current)); @@ -225,3 +225,26 @@ void ipe_audit_policy_load(const struct ipe_policy *const p) audit_log_end(ab); } + +/** + * ipe_audit_enforce() - Audit a change in IPE's enforcement state. + * @new_enforce: The new value enforce to be set. + * @old_enforce: The old value currently in enforce. + */ +void ipe_audit_enforce(bool new_enforce, bool old_enforce) +{ + struct audit_buffer *ab; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS); + if (!ab) + return; + + audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS, + "enforcing=%d old_enforcing=%d auid=%u ses=%u" + " enabled=1 old-enabled=1 lsm=ipe res=1", + new_enforce, old_enforce, + from_kuid(&init_user_ns, audit_get_loginuid(current)), + audit_get_sessionid(current)); + + audit_log_end(ab); +} diff --git a/security/ipe/audit.h b/security/ipe/audit.h index 3ba8b8a91541..ed2620846a79 100644 --- a/security/ipe/audit.h +++ b/security/ipe/audit.h @@ -14,5 +14,6 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx, void ipe_audit_policy_load(const struct ipe_policy *const p); void ipe_audit_policy_activation(const struct ipe_policy *const op, const struct ipe_policy *const np); +void ipe_audit_enforce(bool new_enforce, bool old_enforce); #endif /* _IPE_AUDIT_H */ diff --git a/security/ipe/eval.c b/security/ipe/eval.c index b99ed4bb09cf..b14c95768550 100644 --- a/security/ipe/eval.c +++ b/security/ipe/eval.c @@ -18,6 +18,7 @@ struct ipe_policy __rcu *ipe_active_policy; bool success_audit; +bool enforce = true; #define FILE_SUPERBLOCK(f) ((f)->f_path.mnt->mnt_sb) @@ -108,6 +109,7 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) enum ipe_action_type action; enum ipe_match match_type; bool match = false; + int rc = 0; rcu_read_lock(); @@ -159,9 +161,12 @@ eval: rcu_read_unlock(); if (action == IPE_ACTION_DENY) - return -EACCES; + rc = -EACCES; - return 0; + if (!READ_ONCE(enforce)) + rc = 0; + + return rc; } /* Set the right module name */ @@ -172,3 +177,5 @@ eval: module_param(success_audit, bool, 0400); MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled"); +module_param(enforce, bool, 0400); +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode"); diff --git a/security/ipe/eval.h b/security/ipe/eval.h index 42b74a7a7c2b..80b74f55fa69 100644 --- a/security/ipe/eval.h +++ b/security/ipe/eval.h @@ -16,6 +16,7 @@ extern struct ipe_policy __rcu *ipe_active_policy; extern bool success_audit; +extern bool enforce; struct ipe_superblock { bool initramfs; diff --git a/security/ipe/fs.c b/security/ipe/fs.c index 9e410982b759..b52fb6023904 100644 --- a/security/ipe/fs.c +++ b/security/ipe/fs.c @@ -16,6 +16,7 @@ static struct dentry *np __ro_after_init; static struct dentry *root __ro_after_init; struct dentry *policy_root __ro_after_init; static struct dentry *audit_node __ro_after_init; +static struct dentry *enforce_node __ro_after_init; /** * setaudit() - Write handler for the securityfs node, "ipe/success_audit" @@ -65,6 +66,58 @@ static ssize_t getaudit(struct file *f, char __user *data, return simple_read_from_buffer(data, len, offset, result, 1); } +/** + * setenforce() - Write handler for the securityfs node, "ipe/enforce" + * @f: Supplies a file structure representing the securityfs node. + * @data: Supplies a buffer passed to the write syscall. + * @len: Supplies the length of @data. + * @offset: unused. + * + * Return: + * * Length of buffer written - Success + * * %-EPERM - Insufficient permission + */ +static ssize_t setenforce(struct file *f, const char __user *data, + size_t len, loff_t *offset) +{ + int rc = 0; + bool new_value, old_value; + + if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) + return -EPERM; + + old_value = READ_ONCE(enforce); + rc = kstrtobool_from_user(data, len, &new_value); + if (rc) + return rc; + + if (new_value != old_value) { + ipe_audit_enforce(new_value, old_value); + WRITE_ONCE(enforce, new_value); + } + + return len; +} + +/** + * getenforce() - Read handler for the securityfs node, "ipe/enforce" + * @f: Supplies a file structure representing the securityfs node. + * @data: Supplies a buffer passed to the read syscall. + * @len: Supplies the length of @data. + * @offset: unused. + * + * Return: Length of buffer written + */ +static ssize_t getenforce(struct file *f, char __user *data, + size_t len, loff_t *offset) +{ + const char *result; + + result = ((READ_ONCE(enforce)) ? "1" : "0"); + + return simple_read_from_buffer(data, len, offset, result, 1); +} + /** * new_policy() - Write handler for the securityfs node, "ipe/new_policy". * @f: Supplies a file structure representing the securityfs node. @@ -123,6 +176,11 @@ static const struct file_operations audit_fops = { .read = getaudit, }; +static const struct file_operations enforce_fops = { + .write = setenforce, + .read = getenforce, +}; + /** * ipe_init_securityfs() - Initialize IPE's securityfs tree at fsinit. * @@ -149,6 +207,13 @@ static int __init ipe_init_securityfs(void) goto err; } + enforce_node = securityfs_create_file("enforce", 0600, root, NULL, + &enforce_fops); + if (IS_ERR(enforce_node)) { + rc = PTR_ERR(enforce_node); + goto err; + } + policy_root = securityfs_create_dir("policies", root); if (IS_ERR(policy_root)) { rc = PTR_ERR(policy_root); @@ -165,6 +230,7 @@ static int __init ipe_init_securityfs(void) err: securityfs_remove(np); securityfs_remove(policy_root); + securityfs_remove(enforce_node); securityfs_remove(audit_node); securityfs_remove(root); return rc;