From: Deven Bowers <deven.desai@linux.microsoft.com>
IPE, like SELinux, supports a permissive mode. This mode allows policy
authors to test and evaluate IPE policy without it effecting their
programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
be reported.
This patch adds the following audit records:
audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295
ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295
ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
The audit record only emit when the value from the user input is
different from the current enforce value.
Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
---
v2:
+ Split evaluation loop, access control hooks,
and evaluation loop from policy parser and userspace
interface to pass mailing list character limit
v3:
+ Move ipe_load_properties to patch 04.
+ Remove useless 0-initializations
+ Prefix extern variables with ipe_
+ Remove kernel module parameters, as these are
exposed through sysctls.
+ Add more prose to the IPE base config option
help text.
+ Use GFP_KERNEL for audit_log_start.
+ Remove unnecessary caching system.
+ Remove comments from headers
+ Use rcu_access_pointer for rcu-pointer null check
+ Remove usage of reqprot; use prot only.
+ Move policy load and activation audit event to 03/12
v4:
+ Remove sysctls in favor of securityfs nodes
+ Re-add kernel module parameters, as these are now
exposed through securityfs.
+ Refactor property audit loop to a separate function.
v5:
+ fix minor grammatical errors
+ do not group rule by curly-brace in audit record,
reconstruct the exact rule.
v6:
+ No changes
v7:
+ Further split lsm creation into a separate commit from the
evaluation loop and audit system, for easier review.
+ Propagating changes to support the new ipe_context structure in the
evaluation loop.
+ Split out permissive functionality into a separate patch for easier
review.
+ Remove permissive switch compile-time configuration option - this
is trivial to add later.
v8:
+ Remove "IPE" prefix from permissive audit record
+ align fields to the linux-audit field dictionary. This causes the
following fields to change:
enforce -> permissive
+ Remove duplicated information correlated with syscall record, that
will always be present in the audit event.
+ Change audit types:
+ AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
+ There is no significant difference in meaning between
these types.
v9:
+ Clean up ipe_context related code
v10:
+ Change audit format to comform with the existing format selinux is
using
+ Remove the audit record emission during init to align with selinux,
which does not perform this action.
v11:
+ Remove redundant code
---
security/ipe/audit.c | 22 ++++++++++++++
security/ipe/audit.h | 1 +
security/ipe/eval.c | 14 +++++++--
security/ipe/eval.h | 1 +
security/ipe/fs.c | 68 ++++++++++++++++++++++++++++++++++++++++++++
5 files changed, 104 insertions(+), 2 deletions(-)
diff --git a/security/ipe/audit.c b/security/ipe/audit.c
index e123701d5e3b..0dd5f10c318f 100644
--- a/security/ipe/audit.c
+++ b/security/ipe/audit.c
@@ -193,3 +193,25 @@ void ipe_audit_policy_load(const struct ipe_policy *const p)
audit_log_end(ab);
}
+
+/**
+ * ipe_audit_enforce - Audit a change in IPE's enforcement state.
+ * @new_enforce: The new value enforce to be set.
+ * @old_enforce: The old value currently in enforce.
+ */
+void ipe_audit_enforce(bool new_enforce, bool old_enforce)
+{
+ struct audit_buffer *ab;
+
+ ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS);
+ if (!ab)
+ return;
+
+ audit_log_format(ab, "enforcing=%d old_enforcing=%d auid=%u ses=%u"
+ " enabled=1 old-enabled=1 lsm=ipe res=1",
+ new_enforce, old_enforce,
+ from_kuid(&init_user_ns, audit_get_loginuid(current)),
+ audit_get_sessionid(current));
+
+ audit_log_end(ab);
+}
diff --git a/security/ipe/audit.h b/security/ipe/audit.h
index 0ff5a06808de..914f001e5286 100644
--- a/security/ipe/audit.h
+++ b/security/ipe/audit.h
@@ -14,5 +14,6 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx,
void ipe_audit_policy_load(const struct ipe_policy *const p);
void ipe_audit_policy_activation(const struct ipe_policy *const op,
const struct ipe_policy *const np);
+void ipe_audit_enforce(bool new_enforce, bool old_enforce);
#endif /* _IPE_AUDIT_H */
diff --git a/security/ipe/eval.c b/security/ipe/eval.c
index 499b6b3338f2..78c54ff1fdd3 100644
--- a/security/ipe/eval.c
+++ b/security/ipe/eval.c
@@ -19,6 +19,7 @@
struct ipe_policy __rcu *ipe_active_policy;
bool success_audit;
+bool enforce = true;
static const struct super_block *pinned_sb;
static DEFINE_SPINLOCK(pin_lock);
@@ -114,12 +115,14 @@ static bool evaluate_property(const struct ipe_eval_ctx *const ctx,
int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
{
bool match = false;
+ bool enforcing = true;
enum ipe_action_type action;
enum ipe_match match_type;
struct ipe_policy *pol = NULL;
const struct ipe_rule *rule = NULL;
const struct ipe_op_table *rules = NULL;
struct ipe_prop *prop = NULL;
+ int rc = 0;
rcu_read_lock();
@@ -129,6 +132,8 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
return 0;
}
+ enforcing = READ_ONCE(enforce);
+
if (ctx->op == IPE_OP_INVALID) {
rcu_read_unlock();
action = pol->parsed->global_default_action;
@@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
ipe_audit_match(ctx, match_type, action, rule);
if (action == IPE_ACTION_DENY)
- return -EACCES;
+ rc = -EACCES;
+
+ if (!enforcing)
+ rc = 0;
- return 0;
+ return rc;
}
/**
@@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb)
module_param(success_audit, bool, 0400);
MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
+module_param(enforce, bool, 0400);
+MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");
diff --git a/security/ipe/eval.h b/security/ipe/eval.h
index 5473f712566c..3f7f71452618 100644
--- a/security/ipe/eval.h
+++ b/security/ipe/eval.h
@@ -15,6 +15,7 @@
extern struct ipe_policy __rcu *ipe_active_policy;
extern bool success_audit;
+extern bool enforce;
struct ipe_eval_ctx {
enum ipe_op_type op;
diff --git a/security/ipe/fs.c b/security/ipe/fs.c
index dda7a5afc60c..0a1838432bd0 100644
--- a/security/ipe/fs.c
+++ b/security/ipe/fs.c
@@ -16,6 +16,7 @@ static struct dentry *np __ro_after_init;
static struct dentry *root __ro_after_init;
struct dentry *policy_root __ro_after_init;
static struct dentry *audit_node __ro_after_init;
+static struct dentry *enforce_node __ro_after_init;
/**
* setaudit - Write handler for the securityfs node, "ipe/success_audit"
@@ -67,6 +68,60 @@ static ssize_t getaudit(struct file *f, char __user *data,
return simple_read_from_buffer(data, len, offset, result, 1);
}
+/**
+ * setenforce - Write handler for the securityfs node, "ipe/enforce"
+ * @f: Supplies a file structure representing the securityfs node.
+ * @data: Supplies a buffer passed to the write syscall.
+ * @len: Supplies the length of @data.
+ * @offset: unused.
+ *
+ * Return:
+ * * >0 - Success, Length of buffer written
+ * * <0 - Error
+ */
+static ssize_t setenforce(struct file *f, const char __user *data,
+ size_t len, loff_t *offset)
+{
+ int rc = 0;
+ bool new_value, old_value;
+
+ if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN))
+ return -EPERM;
+
+ old_value = READ_ONCE(enforce);
+ rc = kstrtobool_from_user(data, len, &new_value);
+ if (rc)
+ return rc;
+
+ if (new_value != old_value) {
+ ipe_audit_enforce(new_value, old_value);
+ WRITE_ONCE(enforce, new_value);
+ }
+
+ return len;
+}
+
+/**
+ * getenforce - Read handler for the securityfs node, "ipe/enforce"
+ * @f: Supplies a file structure representing the securityfs node.
+ * @data: Supplies a buffer passed to the read syscall.
+ * @len: Supplies the length of @data.
+ * @offset: unused.
+ *
+ * Return:
+ * * >0 - Success, Length of buffer written
+ * * <0 - Error
+ */
+static ssize_t getenforce(struct file *f, char __user *data,
+ size_t len, loff_t *offset)
+{
+ const char *result;
+
+ result = ((READ_ONCE(enforce)) ? "1" : "0");
+
+ return simple_read_from_buffer(data, len, offset, result, 1);
+}
+
/**
* new_policy - Write handler for the securityfs node, "ipe/new_policy".
* @f: Supplies a file structure representing the securityfs node.
@@ -120,6 +175,11 @@ static const struct file_operations audit_fops = {
.read = getaudit,
};
+static const struct file_operations enforce_fops = {
+ .write = setenforce,
+ .read = getenforce,
+};
+
/**
* ipe_init_securityfs - Initialize IPE's securityfs tree at fsinit.
*
@@ -147,6 +207,13 @@ static int __init ipe_init_securityfs(void)
goto err;
}
+ enforce_node = securityfs_create_file("enforce", 0600, root, NULL,
+ &enforce_fops);
+ if (IS_ERR(enforce_node)) {
+ rc = PTR_ERR(enforce_node);
+ goto err;
+ }
+
policy_root = securityfs_create_dir("policies", root);
if (IS_ERR(policy_root)) {
rc = PTR_ERR(policy_root);
@@ -163,6 +230,7 @@ static int __init ipe_init_securityfs(void)
err:
securityfs_remove(np);
securityfs_remove(policy_root);
+ securityfs_remove(enforce_node);
securityfs_remove(audit_node);
securityfs_remove(root);
return rc;
--
2.25.1On Oct 4, 2023 Fan Wu <wufan@linux.microsoft.com> wrote:
>
> IPE, like SELinux, supports a permissive mode. This mode allows policy
> authors to test and evaluate IPE policy without it effecting their
> programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
> be reported.
>
> This patch adds the following audit records:
>
> audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295
> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
> audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295
> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
>
> The audit record only emit when the value from the user input is
> different from the current enforce value.
>
> Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
> Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
> ---
> v2:
> + Split evaluation loop, access control hooks,
> and evaluation loop from policy parser and userspace
> interface to pass mailing list character limit
>
> v3:
> + Move ipe_load_properties to patch 04.
> + Remove useless 0-initializations
> + Prefix extern variables with ipe_
> + Remove kernel module parameters, as these are
> exposed through sysctls.
> + Add more prose to the IPE base config option
> help text.
> + Use GFP_KERNEL for audit_log_start.
> + Remove unnecessary caching system.
> + Remove comments from headers
> + Use rcu_access_pointer for rcu-pointer null check
> + Remove usage of reqprot; use prot only.
> + Move policy load and activation audit event to 03/12
>
> v4:
> + Remove sysctls in favor of securityfs nodes
> + Re-add kernel module parameters, as these are now
> exposed through securityfs.
> + Refactor property audit loop to a separate function.
>
> v5:
> + fix minor grammatical errors
> + do not group rule by curly-brace in audit record,
> reconstruct the exact rule.
>
> v6:
> + No changes
>
> v7:
> + Further split lsm creation into a separate commit from the
> evaluation loop and audit system, for easier review.
> + Propagating changes to support the new ipe_context structure in the
> evaluation loop.
> + Split out permissive functionality into a separate patch for easier
> review.
> + Remove permissive switch compile-time configuration option - this
> is trivial to add later.
>
> v8:
> + Remove "IPE" prefix from permissive audit record
> + align fields to the linux-audit field dictionary. This causes the
> following fields to change:
> enforce -> permissive
>
> + Remove duplicated information correlated with syscall record, that
> will always be present in the audit event.
> + Change audit types:
> + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
> + There is no significant difference in meaning between
> these types.
>
> v9:
> + Clean up ipe_context related code
>
> v10:
> + Change audit format to comform with the existing format selinux is
> using
> + Remove the audit record emission during init to align with selinux,
> which does not perform this action.
>
> v11:
> + Remove redundant code
> ---
> security/ipe/audit.c | 22 ++++++++++++++
> security/ipe/audit.h | 1 +
> security/ipe/eval.c | 14 +++++++--
> security/ipe/eval.h | 1 +
> security/ipe/fs.c | 68 ++++++++++++++++++++++++++++++++++++++++++++
> 5 files changed, 104 insertions(+), 2 deletions(-)
...
> diff --git a/security/ipe/eval.c b/security/ipe/eval.c
> index 499b6b3338f2..78c54ff1fdd3 100644
> --- a/security/ipe/eval.c
> +++ b/security/ipe/eval.c
> @@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
> ipe_audit_match(ctx, match_type, action, rule);
>
> if (action == IPE_ACTION_DENY)
> - return -EACCES;
> + rc = -EACCES;
> +
> + if (!enforcing)
> + rc = 0;
Why the local @enforcing variable? Why not:
if (!READ_ONCE(enforce))
rc = 0;
> - return 0;
> + return rc;
> }
>
> /**
> @@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb)
>
> module_param(success_audit, bool, 0400);
> MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
> +module_param(enforce, bool, 0400);
> +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");
"enforcing"
--
paul-moore.com
On 10/23/2023 8:52 PM, Paul Moore wrote: > On Oct 4, 2023 Fan Wu <wufan@linux.microsoft.com> wrote: >> >> IPE, like SELinux, supports a permissive mode. This mode allows policy >> authors to test and evaluate IPE policy without it effecting their >> programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS >> be reported. >> >> This patch adds the following audit records: >> >> audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295 >> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 >> audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295 >> ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 >> >> The audit record only emit when the value from the user input is >> different from the current enforce value. >> >> Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com> >> Signed-off-by: Fan Wu <wufan@linux.microsoft.com> >> --- >> v2: >> + Split evaluation loop, access control hooks, >> and evaluation loop from policy parser and userspace >> interface to pass mailing list character limit >> >> v3: >> + Move ipe_load_properties to patch 04. >> + Remove useless 0-initializations >> + Prefix extern variables with ipe_ >> + Remove kernel module parameters, as these are >> exposed through sysctls. >> + Add more prose to the IPE base config option >> help text. >> + Use GFP_KERNEL for audit_log_start. >> + Remove unnecessary caching system. >> + Remove comments from headers >> + Use rcu_access_pointer for rcu-pointer null check >> + Remove usage of reqprot; use prot only. >> + Move policy load and activation audit event to 03/12 >> >> v4: >> + Remove sysctls in favor of securityfs nodes >> + Re-add kernel module parameters, as these are now >> exposed through securityfs. >> + Refactor property audit loop to a separate function. >> >> v5: >> + fix minor grammatical errors >> + do not group rule by curly-brace in audit record, >> reconstruct the exact rule. >> >> v6: >> + No changes >> >> v7: >> + Further split lsm creation into a separate commit from the >> evaluation loop and audit system, for easier review. >> + Propagating changes to support the new ipe_context structure in the >> evaluation loop. >> + Split out permissive functionality into a separate patch for easier >> review. >> + Remove permissive switch compile-time configuration option - this >> is trivial to add later. >> >> v8: >> + Remove "IPE" prefix from permissive audit record >> + align fields to the linux-audit field dictionary. This causes the >> following fields to change: >> enforce -> permissive >> >> + Remove duplicated information correlated with syscall record, that >> will always be present in the audit event. >> + Change audit types: >> + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS >> + There is no significant difference in meaning between >> these types. >> >> v9: >> + Clean up ipe_context related code >> >> v10: >> + Change audit format to comform with the existing format selinux is >> using >> + Remove the audit record emission during init to align with selinux, >> which does not perform this action. >> >> v11: >> + Remove redundant code >> --- >> security/ipe/audit.c | 22 ++++++++++++++ >> security/ipe/audit.h | 1 + >> security/ipe/eval.c | 14 +++++++-- >> security/ipe/eval.h | 1 + >> security/ipe/fs.c | 68 ++++++++++++++++++++++++++++++++++++++++++++ >> 5 files changed, 104 insertions(+), 2 deletions(-) > > ... > >> diff --git a/security/ipe/eval.c b/security/ipe/eval.c >> index 499b6b3338f2..78c54ff1fdd3 100644 >> --- a/security/ipe/eval.c >> +++ b/security/ipe/eval.c >> @@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx) >> ipe_audit_match(ctx, match_type, action, rule); >> >> if (action == IPE_ACTION_DENY) >> - return -EACCES; >> + rc = -EACCES; >> + >> + if (!enforcing) >> + rc = 0; > > Why the local @enforcing variable? Why not: > > if (!READ_ONCE(enforce)) > rc = 0; > Yes the variable is unnecessary, I will remove it. -Fan >> - return 0; >> + return rc; >> } >> >> /** >> @@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb) >> >> module_param(success_audit, bool, 0400); >> MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled"); >> +module_param(enforce, bool, 0400); >> +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode"); > > "enforcing" > > -- > paul-moore.com
© 2016 - 2026 Red Hat, Inc.