ima: instantiate the bprm_creds_for_exec() hook

Like direct file execution (e.g. ./script.sh), indirect file execution
(e.g. sh script.sh) needs to be measured and appraised.  Instantiate
the new security_bprm_creds_for_exec() hook to measure and verify the
indirect file's integrity.  Unlike direct file execution, indirect file
execution is optionally enforced by the interpreter.

Differentiate kernel and userspace enforced integrity audit messages.

Co-developed-by: Roberto Sassu <[email protected]>
Signed-off-by: Roberto Sassu <[email protected]>
Signed-off-by: Mimi Zohar <[email protected]>
Tested-by: Stefan Berger <[email protected]>
Reviewed-by: Mickaël Salaün <[email protected]>
Signed-off-by: Mickaël Salaün <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Kees Cook <[email protected]>

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 75e21a1354838296af3c4cc4c0860f28f521c1c8..d9a069b4a775ea86ae85dd16677b1988abd00fb3 100644 (file)
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -161,6 +161,7 @@
 #define AUDIT_INTEGRITY_RULE       1805 /* policy rule */
 #define AUDIT_INTEGRITY_EVM_XATTR   1806 /* New EVM-covered xattr */
 #define AUDIT_INTEGRITY_POLICY_RULE 1807 /* IMA policy rules */
+#define AUDIT_INTEGRITY_USERSPACE   1808 /* Userspace enforced data integrity */
 
 #define AUDIT_KERNEL           2000    /* Asynchronous audit record. NOT A REQUEST. */
 

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 884a3533f7af21b1f8dc2716fe67c6906b6bad70..f435eff4667f8e9fd8f5f69341937a1090c7c145 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/file.h>
+#include <linux/binfmts.h>
 #include <linux/fs.h>
 #include <linux/xattr.h>
 #include <linux/magic.h>
@@ -469,6 +470,17 @@ int ima_check_blacklist(struct ima_iint_cache *iint,
        return rc;
 }
 
+static bool is_bprm_creds_for_exec(enum ima_hooks func, struct file *file)
+{
+       struct linux_binprm *bprm;
+
+       if (func == BPRM_CHECK) {
+               bprm = container_of(&file, struct linux_binprm, file);
+               return bprm->is_check;
+       }
+       return false;
+}
+
 /*
  * ima_appraise_measurement - appraise file measurement
  *
@@ -483,6 +495,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
                             int xattr_len, const struct modsig *modsig)
 {
        static const char op[] = "appraise_data";
+       int audit_msgno = AUDIT_INTEGRITY_DATA;
        const char *cause = "unknown";
        struct dentry *dentry = file_dentry(file);
        struct inode *inode = d_backing_inode(dentry);
@@ -494,6 +507,16 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
        if (!(inode->i_opflags & IOP_XATTR) && !try_modsig)
                return INTEGRITY_UNKNOWN;
 
+       /*
+        * Unlike any of the other LSM hooks where the kernel enforces file
+        * integrity, enforcing file integrity for the bprm_creds_for_exec()
+        * LSM hook with the AT_EXECVE_CHECK flag is left up to the discretion
+        * of the script interpreter(userspace). Differentiate kernel and
+        * userspace enforced integrity audit messages.
+        */
+       if (is_bprm_creds_for_exec(func, file))
+               audit_msgno = AUDIT_INTEGRITY_USERSPACE;
+
        /* If reading the xattr failed and there's no modsig, error out. */
        if (rc <= 0 && !try_modsig) {
                if (rc && rc != -ENODATA)
@@ -569,7 +592,7 @@ out:
             (iint->flags & IMA_FAIL_UNVERIFIABLE_SIGS))) {
                status = INTEGRITY_FAIL;
                cause = "unverifiable-signature";
-               integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
+               integrity_audit_msg(audit_msgno, inode, filename,
                                    op, cause, rc, 0);
        } else if (status != INTEGRITY_PASS) {
                /* Fix mode, but don't replace file signatures. */
@@ -589,7 +612,7 @@ out:
                        status = INTEGRITY_PASS;
                }
 
-               integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
+               integrity_audit_msg(audit_msgno, inode, filename,
                                    op, cause, rc, 0);
        } else {
                ima_cache_flags(iint, func);

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 9b87556b03a7c0956019a02f168482e3f5fab581..9f9897a7c217eab8cf05470ec0af87c47ad5285f 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -554,6 +554,34 @@ static int ima_bprm_check(struct linux_binprm *bprm)
                                   MAY_EXEC, CREDS_CHECK);
 }
 
+/**
+ * ima_bprm_creds_for_exec - collect/store/appraise measurement.
+ * @bprm: contains the linux_binprm structure
+ *
+ * Based on the IMA policy and the execveat(2) AT_EXECVE_CHECK flag, measure
+ * and appraise the integrity of a file to be executed by script interpreters.
+ * Unlike any of the other LSM hooks where the kernel enforces file integrity,
+ * enforcing file integrity is left up to the discretion of the script
+ * interpreter (userspace).
+ *
+ * On success return 0.  On integrity appraisal error, assuming the file
+ * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
+ */
+static int ima_bprm_creds_for_exec(struct linux_binprm *bprm)
+{
+       /*
+        * As security_bprm_check() is called multiple times, both
+        * the script and the shebang interpreter are measured, appraised,
+        * and audited. Limit usage of this LSM hook to just measuring,
+        * appraising, and auditing the indirect script execution
+        * (e.g. ./sh example.sh).
+        */
+       if (!bprm->is_check)
+               return 0;
+
+       return ima_bprm_check(bprm);
+}
+
 /**
  * ima_file_check - based on policy, collect/store measurement.
  * @file: pointer to the file to be measured
@@ -1174,6 +1202,7 @@ static int __init init_ima(void)
 
 static struct security_hook_list ima_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(bprm_check_security, ima_bprm_check),
+       LSM_HOOK_INIT(bprm_creds_for_exec, ima_bprm_creds_for_exec),
        LSM_HOOK_INIT(file_post_open, ima_file_check),
        LSM_HOOK_INIT(inode_post_create_tmpfile, ima_post_create_tmpfile),
        LSM_HOOK_INIT(file_release, ima_file_free),