From 57b56ac6fecb05c3192586e4892572dd13d972de Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Wed, 21 Feb 2018 11:33:37 -0500 Subject: ima: fail file signature verification on non-init mounted filesystems FUSE can be mounted by unprivileged users either today with fusermount installed with setuid, or soon with the upcoming patches to allow FUSE mounts in a non-init user namespace. This patch addresses the new unprivileged non-init mounted filesystems, which are untrusted, by failing the signature verification. This patch defines two new flags SB_I_IMA_UNVERIFIABLE_SIGNATURE and SB_I_UNTRUSTED_MOUNTER. Signed-off-by: Mimi Zohar Cc: Miklos Szeredi Cc: Seth Forshee Cc: Dongsu Park Cc: Alban Crequy Acked-by: Serge Hallyn Acked-by: "Eric W. Biederman" --- security/integrity/ima/ima_appraise.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'security/integrity') diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 1b17746..4bafb39 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -302,7 +302,19 @@ int ima_appraise_measurement(enum ima_hooks func, } out: - if (status != INTEGRITY_PASS) { + /* + * File signatures on some filesystems can not be properly verified. + * On these filesytems, that are mounted by an untrusted mounter, + * fail the file signature verification. + */ + if ((inode->i_sb->s_iflags & + (SB_I_IMA_UNVERIFIABLE_SIGNATURE | SB_I_UNTRUSTED_MOUNTER)) == + (SB_I_IMA_UNVERIFIABLE_SIGNATURE | SB_I_UNTRUSTED_MOUNTER)) { + status = INTEGRITY_FAIL; + cause = "unverifiable-signature"; + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, + op, cause, rc, 0); + } else if (status != INTEGRITY_PASS) { if ((ima_appraise & IMA_APPRAISE_FIX) && (!xattr_value || xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { @@ -319,6 +331,7 @@ out: } else { ima_cache_flags(iint, func); } + ima_set_cache_status(iint, func, status); return status; } -- cgit v1.1