Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 14 4月, 2021 16 次提交
    • R
      ima: Don't remove security.ima if file must not be appraised · a07594d5
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

Files might come from a remote source and might have xattrs, including
security.ima. It should not be IMA task to decide whether security.ima
should be kept or not. This patch removes the removexattr() system
call in ima_inode_post_setattr().
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      a07594d5
    • R
      ima: Introduce template field evmsig and write to field sig as fallback · b5622fd6
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

With the patch to accept EVM portable signatures when the
appraise_type=imasig requirement is specified in the policy, appraisal can
be successfully done even if the file does not have an IMA signature.

However, remote attestation would not see that a different signature type
was used, as only IMA signatures can be included in the measurement list.
This patch solves the issue by introducing the new template field 'evmsig'
to show EVM portable signatures and by including its value in the existing
field 'sig' if the IMA signature is not found.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Suggested-by: NMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      b5622fd6
    • R
      ima: Allow imasig requirement to be satisfied by EVM portable signatures · bd7071df
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

System administrators can require that all accessed files have a signature
by specifying appraise_type=imasig in a policy rule.

Currently, IMA signatures satisfy this requirement. Appended signatures may
also satisfy this requirement, but are not applicable as IMA signatures.
IMA/appended signatures ensure data source authentication for file content
and prevent any change. EVM signatures instead ensure data source
authentication for file metadata. Given that the digest or signature of the
file content must be included in the metadata, EVM signatures provide the
same file data guarantees of IMA signatures, as well as providing file
metadata guarantees.

This patch lets systems protected with EVM signatures pass appraisal
verification if the appraise_type=imasig requirement is specified in the
policy. This facilitates deployment in the scenarios where only EVM
signatures are available.

The patch makes the following changes:

file xattr types:
security.ima: IMA_XATTR_DIGEST/IMA_XATTR_DIGEST_NG
security.evm: EVM_XATTR_PORTABLE_DIGSIG

execve(), mmap(), open() behavior (with appraise_type=imasig):
before: denied (file without IMA signature, imasig requirement not met)
after: allowed (file with EVM portable signature, imasig requirement met)

open(O_WRONLY) behavior (without appraise_type=imasig):
before: allowed (file without IMA signature, not immutable)
after: denied (file with EVM portable signature, immutable)

In addition, similarly to IMA signatures, this patch temporarily allows
new files without or with incomplete metadata to be opened so that content
can be written.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      bd7071df
    • R
      evm: Allow setxattr() and setattr() for unmodified metadata · ce02fabf
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

With the patch to allow xattr/attr operations if a portable signature
verification fails, cp and tar can copy all xattrs/attrs so that at the
end of the process verification succeeds.

However, it might happen that the xattrs/attrs are already set to the
correct value (taken at signing time) and signature verification succeeds
before the copy has completed. For example, an archive might contains files
owned by root and the archive is extracted by root.

Then, since portable signatures are immutable, all subsequent operations
fail (e.g. fchown()), even if the operation is legitimate (does not alter
the current value).

This patch avoids this problem by reporting successful operation to user
space when that operation does not alter the current value of xattrs/attrs.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      ce02fabf
    • R
      evm: Allow xattr/attr operations for portable signatures · 475be7fa
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

If files with portable signatures are copied from one location to another
or are extracted from an archive, verification can temporarily fail until
all xattrs/attrs are set in the destination. Only portable signatures may
be moved or copied from one file to another, as they don't depend on
system-specific information such as the inode generation. Instead portable
signatures must include security.ima.

Unlike other security.evm types, EVM portable signatures are also
immutable. Thus, it wouldn't be a problem to allow xattr/attr operations
when verification fails, as portable signatures will never be replaced with
the HMAC on possibly corrupted xattrs/attrs.

This patch first introduces a new integrity status called
INTEGRITY_FAIL_IMMUTABLE, that allows callers of
evm_verify_current_integrity() to detect that a portable signature didn't
pass verification and then adds an exception in evm_protect_xattr() and
evm_inode_setattr() for this status and returns 0 instead of -EPERM.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      475be7fa
    • R
      evm: Ignore INTEGRITY_NOLABEL/INTEGRITY_NOXATTRS if conditions are safe · f74c413c
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

When a file is being created, LSMs can set the initial label with the
inode_init_security hook. If no HMAC key is loaded, the new file will have
LSM xattrs but not the HMAC. It is also possible that the file remains
without protected xattrs after creation if no active LSM provided it.

Unfortunately, EVM will deny any further metadata operation on new files,
as evm_protect_xattr() will always return the INTEGRITY_NOLABEL error, or
INTEGRITY_NOXATTRS if no protected xattrs exist. This would limit the
usability of EVM when only a public key is loaded, as commands such as cp
or tar with the option to preserve xattrs won't work.

This patch ignores these errors when they won't be an issue, if no HMAC key
is loaded and cannot be loaded in the future (which can be enforced by
setting the EVM_SETUP_COMPLETE initialization flag).
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      f74c413c
    • R
      evm: Introduce evm_status_revalidate() · 1c8c2846
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

When EVM_ALLOW_METADATA_WRITES is set, EVM allows any operation on
metadata. Its main purpose is to allow users to freely set metadata when it
is protected by a portable signature, until an HMAC key is loaded.

However, callers of evm_verifyxattr() are not notified about metadata
changes and continue to rely on the last status returned by the function.
For example IMA, since it caches the appraisal result, will not call again
evm_verifyxattr() until the appraisal flags are cleared, and will grant
access to the file even if there was a metadata operation that made the
portable signature invalid.

This patch introduces evm_status_revalidate(), which callers of
evm_verifyxattr() can use in their xattr post hooks to determine whether
re-validation is necessary and to do the proper actions. IMA calls it in
its xattr post hooks to reset the appraisal flags, so that the EVM status
is re-evaluated after a metadata operation.

Lastly, this patch also adds a call to evm_reset_status() in
evm_inode_post_setattr() to invalidate the cached EVM status after a
setattr operation.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      1c8c2846
    • R
      ima: Move ima_reset_appraise_flags() call to post hooks · d3df8e70
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

ima_inode_setxattr() and ima_inode_removexattr() hooks are called before an
operation is performed. Thus, ima_reset_appraise_flags() should not be
called there, as flags might be unnecessarily reset if the operation is
denied.

This patch introduces the post hooks ima_inode_post_setxattr() and
ima_inode_post_removexattr(), and adds the call to
ima_reset_appraise_flags() in the new functions.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      d3df8e70
    • R
      evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded · 9b772f49
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to
temporarily disable metadata verification until all xattrs/attrs necessary
to verify an EVM portable signature are copied to the file. This flag is
cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is
calculated on unverified xattrs/attrs.

Currently EVM unnecessarily denies setting this flag if EVM is initialized
with a public key, which is not a concern as it cannot be used to trust
xattrs/attrs updates. This patch removes this limitation.

Cc: stable@vger.kernel.org # 4.16.x
Fixes: ae1ba167 ("EVM: Allow userland to permit modification of EVM-protected metadata")
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      9b772f49
    • R
      evm: Load EVM key in ima_load_x509() to avoid appraisal · 9a37a4f2
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

Public keys do not need to be appraised by IMA as the restriction on the
IMA/EVM keyrings ensures that a key can be loaded only if it is signed with
a key in the primary or secondary keyring.

However, when evm_load_x509() is called, appraisal is already enabled and
a valid IMA signature must be added to the EVM key to pass verification.

Since the restriction is applied on both IMA and EVM keyrings, it is safe
to disable appraisal also when the EVM key is loaded. This patch calls
evm_load_x509() inside ima_load_x509() if CONFIG_IMA_LOAD_X509 is enabled.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      9a37a4f2
    • R
      evm: Execute evm_inode_init_security() only when an HMAC key is loaded · 92aa9c3e
      由 Roberto Sassu 提交于 
      hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

---------------------------

evm_inode_init_security() requires an HMAC key to calculate the HMAC on
initial xattrs provided by LSMs. However, it checks generically whether a
key has been loaded, including also public keys, which is not correct as
public keys are not suitable to calculate the HMAC.

Originally, support for signature verification was introduced to verify a
possibly immutable initial ram disk, when no new files are created, and to
switch to HMAC for the root filesystem. By that time, an HMAC key should
have been loaded and usable to calculate HMACs for new files.

More recently support for requiring an HMAC key was removed from the
kernel, so that signature verification can be used alone. Since this is a
legitimate use case, evm_inode_init_security() should not return an error
when no HMAC key has been loaded.

This patch fixes this problem by replacing the evm_key_loaded() check with
a check of the EVM_INIT_HMAC flag in evm_initialized.

Cc: stable@vger.kernel.org # 4.5.x
Fixes: 26ddabfe ("evm: enable EVM when X509 certificate is loaded")
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: NMimi Zohar <zohar@linux.ibm.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      92aa9c3e
    • Y
      cgroup: disable kernel memory accounting for all memory cgroups by default · 07965240
      由 Yang Yingliang 提交于 
      hulk inclusion
category: bugfix
Bugzilla: 50424
CVE: NA

----------------------------------------

The kernel memory accounting for all memory cgroups is
not stable, and it will cause a 100% regression in
hackbench compared with kernel-4.19, so disable it by
default. We can use the following command line to enable
or disable it:
cgroup.memory=kmem or cgroup.memory=kmem.
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NKefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      07965240
    • L
      etmem: Modify the memig feature name to etmem · aa7f1d22
      由 liubo 提交于 
      euleros inclusion
category: feature
feature: etmem
bugzilla: 48246

-------------------------------------------------

The original memory extension feature name is memig,
after open source the feature name is changed to etmem.

This patch is used to synchronously modify the feature name and file
name.

The config options and the file name are modified synchronously to etmem.
Signed-off-by: Nliubo <liubo254@huawei.com>
Reviewed-by: Ngeruijun <geruijun@huawei.com>
Reviewed-by: NXiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      aa7f1d22
    • L
      memig: fix compile error when CONFIG_NUMA is turned off · 74706f34
      由 liubo 提交于 
      euleros inclusion
category: feature
feature: memig
bugzilla: 48246

-------------------------------------------------

fix compile error when CONFIG_NUMA is turned off on Raspberry platform.

compile info:
mm/vmscan.c: In function ‘get_page_from_vaddr’:
mm/vmscan.c:4350:40: error: implicit declaration of function ‘vma_migratable’;
did you mean ‘rq_mergeable’? [-Werror=implicit-function-declaration]

This patch solves the problem of compilation errors
introduced by memig into the interface in the vmscan.c
file. Delete dependency on NUMA for CONFIG_MEMIG_SWAP,
and use vma->vm_flags & VM_LOCKED for judgement.
Signed-off-by: Nliubo <liubo254@huawei.com>
Reviewed-by: NJing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      74706f34
    • L
      memig: add memig-swap feature to openEuler · 8a655676
      由 liubo 提交于 
      euleros inclusion
category: feature
feature: add memig swap feature patch to openEuler kernel
bugzilla: 48246

-------------------------------------------------

reason:This patch is used to add memig swap feature to openEuler system.
memig_swap.ko is used to transfer the address
passed in the user state for page migration
Signed-off-by: Nyanxiaodan <yanxiaodan@huawei.com>
Signed-off-by: Nlinmiaohe <linmiaohe@huawei.com>
Signed-off-by: Nlouhongxiang <louhongxiang@huawei.com>
Signed-off-by: Nliubo <liubo254@huawei.com>
Signed-off-by: Ngeruijun <geruijun@huawei.com>
Signed-off-by: Nliangchenshu <liangchenshu@huawei.com>
Reviewed-by: NJing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      8a655676
    • L
      memig: add memig-scan feature to openEuler · c13e5b6a
      由 liubo 提交于 
      euleros inclusion
category: feature
feature: add memig scan feature patch to openEuler kernel
bugzilla: 48246

-------------------------------------------------

reason:This patch is used to add memig scan feature to openEuler system.
memig_scan.ko is used to scan the virtual address of the target process
and return the address access information to
the user mode for grading cold and hot pages.
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Nyanxiaodan <yanxiaodan@huawei.com>
Signed-off-by: NFeilong Lin <linfeilong@huawei.com>
Signed-off-by: Ngeruijun <geruijun@huawei.com>
Signed-off-by: Nliubo <liubo254@huawei.com>
Reviewed-by: NJing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
      c13e5b6a
  3. 13 4月, 2021 24 次提交