Date: Tue, 30 Nov 2021 11:35:00 +0100 From: Mickaël Salaün <mic@...ikod.net> To: Al Viro <viro@...iv.linux.org.uk>, Andrew Morton <akpm@...ux-foundation.org> Cc: Alejandro Colomar <alx.manpages@...il.com>, Aleksa Sarai <cyphar@...har.com>, Andy Lutomirski <luto@...nel.org>, Arnd Bergmann <arnd@...db.de>, Casey Schaufler <casey@...aufler-ca.com>, Christian Brauner <christian.brauner@...ntu.com>, Christian Heimes <christian@...hon.org>, Deven Bowers <deven.desai@...ux.microsoft.com>, Dmitry Vyukov <dvyukov@...gle.com>, Eric Biggers <ebiggers@...nel.org>, Eric Chiang <ericchiang@...gle.com>, Florian Weimer <fweimer@...hat.com>, Geert Uytterhoeven <geert@...ux-m68k.org>, James Morris <jmorris@...ei.org>, Jan Kara <jack@...e.cz>, Jann Horn <jannh@...gle.com>, Jonathan Corbet <corbet@....net>, Kees Cook <keescook@...omium.org>, Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>, "Madhavan T . Venkataraman" <madvenka@...ux.microsoft.com>, Matthew Garrett <mjg59@...gle.com>, Matthew Wilcox <willy@...radead.org>, Miklos Szeredi <mszeredi@...hat.com>, Mimi Zohar <zohar@...ux.ibm.com>, Paul Moore <paul@...l-moore.com>, Philippe Trébuchet <philippe.trebuchet@....gouv.fr>, Scott Shell <scottsh@...rosoft.com>, Shuah Khan <shuah@...nel.org>, Steve Dower <steve.dower@...hon.org>, Steve Grubb <sgrubb@...hat.com>, Thibaut Sautereau <thibaut.sautereau@....gouv.fr>, Vincent Strubel <vincent.strubel@....gouv.fr>, Yin Fengwei <fengwei.yin@...el.com>, kernel-hardening@...ts.openwall.com, linux-api@...r.kernel.org, linux-fsdevel@...r.kernel.org, linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org Subject: Re: [PATCH v17 0/3] Add trusted_for(2) (was O_MAYEXEC) Hello Al, I think there is no more comment on this series, everything has been addressed. Could you please consider to merge this into your tree or push it to linux-next? Regards, Mickaël On 15/11/2021 19:53, Mickaël Salaün wrote: > Hi, > > This new patch series fix the syscall signature as suggested by > Alejandro Colomar. It applies on Linus's master branch (v5.16-rc1) and > next-20211115. > > Andrew, can you please consider to merge this into your tree? > > Overview > ======== > > The final goal of this patch series is to enable the kernel to be a > global policy manager by entrusting processes with access control at > their level. To reach this goal, two complementary parts are required: > * user space needs to be able to know if it can trust some file > descriptor content for a specific usage; > * and the kernel needs to make available some part of the policy > configured by the system administrator. > > Primary goal of trusted_for(2) > ============================== > > This new syscall enables user space to ask the kernel: is this file > descriptor's content trusted to be used for this purpose? The set of > usage currently only contains execution, but other may follow (e.g. > configuration, sensitive data). If the kernel identifies the file > descriptor as trustworthy for this usage, user space should then take > this information into account. The "execution" usage means that the > content of the file descriptor is trusted according to the system policy > to be executed by user space, which means that it interprets the content > or (try to) maps it as executable memory. > > A simple system-wide security policy can be set by the system > administrator through a sysctl configuration consistent with the mount > points or the file access rights. The documentation explains the > prerequisites. > > It is important to note that this can only enable to extend access > control managed by the kernel. Hence it enables current access control > mechanism to be extended and become a superset of what they can > currently control. Indeed, the security policy could also be delegated > to an LSM, either a MAC system or an integrity system. For instance, > this is required to close a major IMA measurement/appraisal interpreter > integrity gap by bringing the ability to check the use of scripts . > Other uses are expected, such as for magic-links , SGX integration > , bpffs . > > Complementary W^X protections can be brought by SELinux, IPE  and > trampfd . > > System call description > ======================= > > trusted_for(int fd, enum trusted_for_usage usage, u32 flags); > > @fd is the file descriptor to check. > > @usage identifies the user space usage intended for @fd: only > TRUSTED_FOR_EXECUTION for now, but trusted_for_usage could be extended > to identify other usages (e.g. configuration, sensitive data). > > @flags must be 0 for now but it could be used in the future to do > complementary checks (e.g. signature or integrity requirements, origin > of the file). > > This system call returns 0 on success, or -EACCES if the kernel policy > denies the specified usage (which should be enforced by the caller). > > The first patch contains the full syscall and sysctl documentation. > > Prerequisite of its use > ======================= > > User space needs to adapt to take advantage of this new feature. For > example, the PEP 578  (Runtime Audit Hooks) enables Python 3.8 to be > extended with policy enforcement points related to code interpretation, > which can be used to align with the PowerShell audit features. > Additional Python security improvements (e.g. a limited interpreter > without -c, stdin piping of code) are on their way . > > Examples > ======== > > The initial idea comes from CLIP OS 4 and the original implementation > has been used for more than 13 years: > https://github.com/clipos-archive/clipos4_doc > Chrome OS has a similar approach: > https://chromium.googlesource.com/chromiumos/docs/+/master/security/noexec_shell_scripts.md > > Userland patches can be found here: > https://github.com/clipos-archive/clipos4_portage-overlay/search?q=O_MAYEXEC > Actually, there is more than the O_MAYEXEC changes (which matches this search) > e.g., to prevent Python interactive execution. There are patches for > Bash, Wine, Java (Icedtea), Busybox's ash, Perl and Python. There are > also some related patches which do not directly rely on O_MAYEXEC but > which restrict the use of browser plugins and extensions, which may be > seen as scripts too: > https://github.com/clipos-archive/clipos4_portage-overlay/tree/master/www-client > > An introduction to O_MAYEXEC was given at the Linux Security Summit > Europe 2018 - Linux Kernel Security Contributions by ANSSI: > https://www.youtube.com/watch?v=chNjCRtPKQY&t=17m15s > The "write xor execute" principle was explained at Kernel Recipes 2018 - > CLIP OS: a defense-in-depth OS: > https://www.youtube.com/watch?v=PjRE0uBtkHU&t=11m14s > See also a first LWN article about O_MAYEXEC and a new one about > trusted_for(2) and its background: > * https://lwn.net/Articles/820000/ > * https://lwn.net/Articles/832959/ > > This can be tested with CONFIG_SYSCTL. I would really appreciate > constructive comments on this patch series. > >  https://email@example.com/ >  https://firstname.lastname@example.org/ >  https://lore.kernel.org/lkml/CALCETrVovr8XNZSroey7pHF46O=kj_c5D9K8h=z2T_cNrpvMig@mail.gmail.com/ >  https://lore.kernel.org/lkml/CALCETrVeZ0eufFXwfhtaG_j+AdvbzEWE0M3wjXMWVEO7pjemail@example.com/ >  https://firstname.lastname@example.org/ >  https://email@example.com/ >  https://www.python.org/dev/peps/pep-0578/ >  https://firstname.lastname@example.org/ > > Previous versions: > v16: https://email@example.com/ > v15: https://firstname.lastname@example.org/ > v14: https://email@example.com/ > v13: https://firstname.lastname@example.org/ > v12: https://email@example.com/ > v11: https://firstname.lastname@example.org/ > v10: https://email@example.com/ > v9: https://firstname.lastname@example.org/ > v8: https://email@example.com/ > v7: https://firstname.lastname@example.org/ > v6: https://email@example.com/ > v5: https://firstname.lastname@example.org/ > v4: https://email@example.com/ > v3: https://firstname.lastname@example.org/ > v2: https://email@example.com/ > v1: https://firstname.lastname@example.org/ > > Regards, > > Mickaël Salaün (3): > fs: Add trusted_for(2) syscall implementation and related sysctl > arch: Wire up trusted_for(2) > selftest/interpreter: Add tests for trusted_for(2) policies > > Documentation/admin-guide/sysctl/fs.rst | 50 +++ > arch/alpha/kernel/syscalls/syscall.tbl | 2 + > arch/arm/tools/syscall.tbl | 1 + > arch/arm64/include/asm/unistd.h | 2 +- > arch/arm64/include/asm/unistd32.h | 2 + > arch/ia64/kernel/syscalls/syscall.tbl | 2 + > arch/m68k/kernel/syscalls/syscall.tbl | 2 + > arch/microblaze/kernel/syscalls/syscall.tbl | 2 + > arch/mips/kernel/syscalls/syscall_n32.tbl | 2 + > arch/mips/kernel/syscalls/syscall_n64.tbl | 2 + > arch/mips/kernel/syscalls/syscall_o32.tbl | 2 + > arch/parisc/kernel/syscalls/syscall.tbl | 2 + > arch/powerpc/kernel/syscalls/syscall.tbl | 2 + > arch/s390/kernel/syscalls/syscall.tbl | 2 + > arch/sh/kernel/syscalls/syscall.tbl | 2 + > arch/sparc/kernel/syscalls/syscall.tbl | 2 + > arch/x86/entry/syscalls/syscall_32.tbl | 1 + > arch/x86/entry/syscalls/syscall_64.tbl | 1 + > arch/xtensa/kernel/syscalls/syscall.tbl | 2 + > fs/open.c | 111 ++++++ > include/linux/fs.h | 1 + > include/linux/syscalls.h | 1 + > include/uapi/asm-generic/unistd.h | 4 +- > include/uapi/linux/trusted-for.h | 18 + > kernel/sysctl.c | 12 +- > tools/testing/selftests/Makefile | 1 + > .../testing/selftests/interpreter/.gitignore | 2 + > tools/testing/selftests/interpreter/Makefile | 21 + > tools/testing/selftests/interpreter/config | 1 + > .../selftests/interpreter/trust_policy_test.c | 362 ++++++++++++++++++ > 30 files changed, 613 insertions(+), 4 deletions(-) > create mode 100644 include/uapi/linux/trusted-for.h > create mode 100644 tools/testing/selftests/interpreter/.gitignore > create mode 100644 tools/testing/selftests/interpreter/Makefile > create mode 100644 tools/testing/selftests/interpreter/config > create mode 100644 tools/testing/selftests/interpreter/trust_policy_test.c > > > base-commit: 8ab774587903771821b59471cc723bba6d893942 >
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.