From 31f8c8682f30720be25e9b1021caa43c64e8d9ce Mon Sep 17 00:00:00 2001 From: Fan Wu Date: Fri, 2 Aug 2024 23:08:30 -0700 Subject: ipe: enable support for fs-verity as a trust provider Enable IPE policy authors to indicate trust for a singular fsverity file, identified by the digest information, through "fsverity_digest" and all files using valid fsverity builtin signatures via "fsverity_signature". This enables file-level integrity claims to be expressed in IPE, allowing individual files to be authorized, giving some flexibility for policy authors. Such file-level claims are important to be expressed for enforcing the integrity of packages, as well as address some of the scalability issues in a sole dm-verity based solution (# of loop back devices, etc). This solution cannot be done in userspace as the minimum threat that IPE should mitigate is an attacker downloads malicious payload with all required dependencies. These dependencies can lack the userspace check, bypassing the protection entirely. A similar attack succeeds if the userspace component is replaced with a version that does not perform the check. As a result, this can only be done in the common entry point - the kernel. Signed-off-by: Deven Bowers Signed-off-by: Fan Wu Signed-off-by: Paul Moore --- security/ipe/audit.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'security/ipe/audit.c') diff --git a/security/ipe/audit.c b/security/ipe/audit.c index 8e21879e96c7..f05f0caa4850 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -56,6 +56,9 @@ static const char *const audit_prop_names[__IPE_PROP_MAX] = { "dmverity_roothash=", "dmverity_signature=FALSE", "dmverity_signature=TRUE", + "fsverity_digest=", + "fsverity_signature=FALSE", + "fsverity_signature=TRUE", }; /** @@ -69,6 +72,17 @@ static void audit_dmv_roothash(struct audit_buffer *ab, const void *rh) ipe_digest_audit(ab, rh); } +/** + * audit_fsv_digest() - audit the digest of a fsverity_digest property. + * @ab: Supplies a pointer to the audit_buffer to append to. + * @d: Supplies a pointer to the digest structure. + */ +static void audit_fsv_digest(struct audit_buffer *ab, const void *d) +{ + audit_log_format(ab, "%s", audit_prop_names[IPE_PROP_FSV_DIGEST]); + ipe_digest_audit(ab, d); +} + /** * audit_rule() - audit an IPE policy rule. * @ab: Supplies a pointer to the audit_buffer to append to. @@ -85,6 +99,9 @@ static void audit_rule(struct audit_buffer *ab, const struct ipe_rule *r) case IPE_PROP_DMV_ROOTHASH: audit_dmv_roothash(ab, ptr->value); break; + case IPE_PROP_FSV_DIGEST: + audit_fsv_digest(ab, ptr->value); + break; default: audit_log_format(ab, "%s", audit_prop_names[ptr->type]); break; -- cgit v1.2.3