Re: [PATCH RFC v11 9/19] ipe: add permissive toggle

[Fan Wu]

On 10/23/2023 8:52 PM, Paul Moore wrote:
> On Oct  4, 2023 Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx> wrote:
> > IPE, like SELinux, supports a permissive mode. This mode allows policy
> > authors to test and evaluate IPE policy without it effecting their
> > programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
> > be reported.
> >
> > This patch adds the following audit records:
> >
> >      audit: MAC_STATUS enforcing=0 old_enforcing=1 auid=4294967295
> >        ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
> >      audit: MAC_STATUS enforcing=1 old_enforcing=0 auid=4294967295
> >        ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
> >
> > The audit record only emit when the value from the user input is
> > different from the current enforce value.
> >
> > Signed-off-by: Deven Bowers <deven.desai@xxxxxxxxxxxxxxxxxxx>
> > Signed-off-by: Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx>
> > ---
> > v2:
> >    + Split evaluation loop, access control hooks,
> >      and evaluation loop from policy parser and userspace
> >      interface to pass mailing list character limit
> >
> > v3:
> >    + Move ipe_load_properties to patch 04.
> >    + Remove useless 0-initializations
> >    + Prefix extern variables with ipe_
> >    + Remove kernel module parameters, as these are
> >      exposed through sysctls.
> >    + Add more prose to the IPE base config option
> >      help text.
> >    + Use GFP_KERNEL for audit_log_start.
> >    + Remove unnecessary caching system.
> >    + Remove comments from headers
> >    + Use rcu_access_pointer for rcu-pointer null check
> >    + Remove usage of reqprot; use prot only.
> >    + Move policy load and activation audit event to 03/12
> >
> > v4:
> >    + Remove sysctls in favor of securityfs nodes
> >    + Re-add kernel module parameters, as these are now
> >      exposed through securityfs.
> >    + Refactor property audit loop to a separate function.
> >
> > v5:
> >    + fix minor grammatical errors
> >    + do not group rule by curly-brace in audit record,
> >      reconstruct the exact rule.
> >
> > v6:
> >    + No changes
> >
> > v7:
> >    + Further split lsm creation into a separate commit from the
> >      evaluation loop and audit system, for easier review.
> >    + Propagating changes to support the new ipe_context structure in the
> >      evaluation loop.
> >    + Split out permissive functionality into a separate patch for easier
> >      review.
> >    + Remove permissive switch compile-time configuration option - this
> >      is trivial to add later.
> >
> > v8:
> >    + Remove "IPE" prefix from permissive audit record
> >    + align fields to the linux-audit field dictionary. This causes the
> >      following fields to change:
> >        enforce -> permissive
> >
> >    + Remove duplicated information correlated with syscall record, that
> >      will always be present in the audit event.
> >    + Change audit types:
> >      + AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
> >        + There is no significant difference in meaning between
> >          these types.
> >
> > v9:
> >    + Clean up ipe_context related code
> >
> > v10:
> >    + Change audit format to comform with the existing format selinux is
> >      using
> >    + Remove the audit record emission during init to align with selinux,
> >      which does not perform this action.
> >
> > v11:
> >    + Remove redundant code
> > ---
> >   security/ipe/audit.c | 22 ++++++++++++++
> >   security/ipe/audit.h |  1 +
> >   security/ipe/eval.c  | 14 +++++++--
> >   security/ipe/eval.h  |  1 +
> >   security/ipe/fs.c    | 68 ++++++++++++++++++++++++++++++++++++++++++++
> >   5 files changed, 104 insertions(+), 2 deletions(-)
>
> ...
>
> > diff --git a/security/ipe/eval.c b/security/ipe/eval.c
> > index 499b6b3338f2..78c54ff1fdd3 100644
> > --- a/security/ipe/eval.c
> > +++ b/security/ipe/eval.c
> > @@ -167,9 +172,12 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
> >   	ipe_audit_match(ctx, match_type, action, rule);
> >   
> >   	if (action == IPE_ACTION_DENY)
> > -		return -EACCES;
> > +		rc = -EACCES;
> > +
> > +	if (!enforcing)
> > +		rc = 0;
>
> Why the local @enforcing variable?  Why not:
>
>    if (!READ_ONCE(enforce))
>      rc = 0;

Yes the variable is unnecessary, I will remove it.
-Fan
> > -	return 0;
> > +	return rc;
> >   }
> >   
> >   /**
> > @@ -198,3 +206,5 @@ void ipe_invalidate_pinned_sb(const struct super_block *mnt_sb)
> >   
> >   module_param(success_audit, bool, 0400);
> >   MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
> > +module_param(enforce, bool, 0400);
> > +MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");
>
> "enforcing"
>
> --
> paul-moore.com