diff options
| author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2018-02-21 17:33:37 +0100 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2018-03-23 11:31:37 +0100 |
| commit | 57b56ac6fecb05c3192586e4892572dd13d972de (patch) | |
| tree | 125efeee62e9ec9a3fc99a761151569cdba7e26c | |
| parent | IMA: Support using new creds in appraisal policy (diff) | |
| download | linux-57b56ac6fecb05c3192586e4892572dd13d972de.tar.xz linux-57b56ac6fecb05c3192586e4892572dd13d972de.zip | |
ima: fail file signature verification on non-init mounted filesystems
FUSE can be mounted by unprivileged users either today with fusermount
installed with setuid, or soon with the upcoming patches to allow FUSE
mounts in a non-init user namespace.
This patch addresses the new unprivileged non-init mounted filesystems,
which are untrusted, by failing the signature verification.
This patch defines two new flags SB_I_IMA_UNVERIFIABLE_SIGNATURE and
SB_I_UNTRUSTED_MOUNTER.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Dongsu Park <dongsu@kinvolk.io>
Cc: Alban Crequy <alban@kinvolk.io>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
| -rw-r--r-- | include/linux/fs.h | 2 | ||||
| -rw-r--r-- | security/integrity/ima/ima_appraise.c | 15 |
2 files changed, 16 insertions, 1 deletions
diff --git a/include/linux/fs.h b/include/linux/fs.h index c6baf767619e..d9e60824c374 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1321,6 +1321,8 @@ extern int send_sigurg(struct fown_struct *fown); /* sb->s_iflags to limit user namespace mounts */ #define SB_I_USERNS_VISIBLE 0x00000010 /* fstype already mounted */ +#define SB_I_IMA_UNVERIFIABLE_SIGNATURE 0x00000020 +#define SB_I_UNTRUSTED_MOUNTER 0x00000040 /* Possible states of 'frozen' field */ enum { diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 1b177461f20e..4bafb397ee91 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -302,7 +302,19 @@ int ima_appraise_measurement(enum ima_hooks func, } out: - if (status != INTEGRITY_PASS) { + /* + * File signatures on some filesystems can not be properly verified. + * On these filesytems, that are mounted by an untrusted mounter, + * fail the file signature verification. + */ + if ((inode->i_sb->s_iflags & + (SB_I_IMA_UNVERIFIABLE_SIGNATURE | SB_I_UNTRUSTED_MOUNTER)) == + (SB_I_IMA_UNVERIFIABLE_SIGNATURE | SB_I_UNTRUSTED_MOUNTER)) { + status = INTEGRITY_FAIL; + cause = "unverifiable-signature"; + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, + op, cause, rc, 0); + } else if (status != INTEGRITY_PASS) { if ((ima_appraise & IMA_APPRAISE_FIX) && (!xattr_value || xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { @@ -319,6 +331,7 @@ out: } else { ima_cache_flags(iint, func); } + ima_set_cache_status(iint, func, status); return status; } |