github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ipe/stable-7.4 PR 20261019

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iIcEABYIAC8WIQQzmBmZPBN6m/hUJmnyomI6a/yO7QUCata16hEcd3VmYW5Aa2Vy
 bmVsLm9yZwAKCRDyomI6a/yO7fWMAP416s5s3d9o4r/ZiSzs/4ZqoFQcffMlnJAM
 /PbtwC1fKwD/WDlfsk+aydwK8vamTeA0sWI9dkxtxx3a42Lik46ATw4=
 =4oH1
 -----END PGP SIGNATURE-----

Merge tag 'ipe-pr-20261019' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe

Pull IPE updates from Fan Wu:

 - Fix an extra empty audit record on enforcement changes

   ipe_audit_enforce() started an audit buffer but logged the state
   change with audit_log(), which emits its own record. Ending the
   unused buffer produced an additional empty AUDIT_MAC_STATUS record
   every time the enforcement state was changed.

 - Keep the name and token tables in sync with their enums

   The audit name tables now use designated initializers, so each name
   stays bound to its enum value, and static assertions on the policy
   parser token tables break the build if an enum value is added without
   a matching token.

 - Constify token_default() and correct a comment about policy text
   ownership, with no functional changes

 - Fix an invalid sgid value in an audit event example in the docs

 - Point the docs to the new IPE website and test suite repository

* tag 'ipe-pr-20261019' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:
  ipe: update the project and test suite links
  ipe: fix enforcement audit
  ipe: correct policy text ownership comment
  ipe: check parser token table sizes
  ipe: use designated initializers for audit name tables
  ipe: constify token_default()
  ipe: fix invalid sgid value in audit event documentation
This commit is contained in:
Linus Torvalds 2026-10-22 09:55:12 -10:00
commit bbc48daeca
5 changed files with 36 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Documentation/admin-guide/LSM/ipe.rst
View File

@ -502,11 +502,11 @@ The following table lists the error codes that may appear in the errno field whi
Event Examples::
type=1404 audit(1653425689.008:55): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=)
type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
type=1327 audit(1653425689.008:55): proctitle="-bash"
type=1404 audit(1653425689.008:55): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=)
type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
type=1327 audit(1653425689.008:55): proctitle="-bash"
This record will always be emitted in conjunction with a ``AUDITSYSCALL`` record for the ``write`` syscall.
@ -791,7 +791,7 @@ Allow execution of a specific fs-verity file
Additional Information
----------------------
- `Github Repository <https://github.com/microsoft/ipe>`_
- `IPE website <https://ipe-lsm.org/>`_
- :doc:`Developer and design docs for IPE </security/ipe>`
FAQ

2
Documentation/security/ipe.rst
View File

@ -442,5 +442,5 @@ IPE has KUnit Tests for the policy parser. Recommended kunitconfig::
CONFIG_SECURITY_IPE_KUNIT_TEST=y
In addition, IPE has a python based integration
`test suite <https://github.com/microsoft/ipe/tree/test-suite>`_ that
`test suite <https://github.com/Integrity-Policy-Enforcement/ci>`_ that
can test both user interfaces and enforcement functionalities.

52
security/ipe/audit.c
View File

@ -34,34 +34,34 @@
"new_policy_digest=" IPE_AUDIT_HASH_ALG ":"
static const char *const audit_op_names[__IPE_OP_MAX + 1] = {
"EXECUTE",
"FIRMWARE",
"KMODULE",
"KEXEC_IMAGE",
"KEXEC_INITRAMFS",
"POLICY",
"X509_CERT",
"UNKNOWN",
[IPE_OP_EXEC] = "EXECUTE",
[IPE_OP_FIRMWARE] = "FIRMWARE",
[IPE_OP_KERNEL_MODULE] = "KMODULE",
[IPE_OP_KEXEC_IMAGE] = "KEXEC_IMAGE",
[IPE_OP_KEXEC_INITRAMFS] = "KEXEC_INITRAMFS",
[IPE_OP_POLICY] = "POLICY",
[IPE_OP_X509] = "X509_CERT",
[IPE_OP_INVALID] = "UNKNOWN",
};
static const char *const audit_hook_names[__IPE_HOOK_MAX] = {
"BPRM_CHECK",
"BPRM_CREDS_FOR_EXEC",
"MMAP",
"MPROTECT",
"KERNEL_READ",
"KERNEL_LOAD",
[IPE_HOOK_BPRM_CHECK] = "BPRM_CHECK",
[IPE_HOOK_BPRM_CREDS_FOR_EXEC] = "BPRM_CREDS_FOR_EXEC",
[IPE_HOOK_MMAP] = "MMAP",
[IPE_HOOK_MPROTECT] = "MPROTECT",
[IPE_HOOK_KERNEL_READ] = "KERNEL_READ",
[IPE_HOOK_KERNEL_LOAD] = "KERNEL_LOAD",
};
static const char *const audit_prop_names[__IPE_PROP_MAX] = {
"boot_verified=FALSE",
"boot_verified=TRUE",
"dmverity_roothash=",
"dmverity_signature=FALSE",
"dmverity_signature=TRUE",
"fsverity_digest=",
"fsverity_signature=FALSE",
"fsverity_signature=TRUE",
[IPE_PROP_BOOT_VERIFIED_FALSE] = "boot_verified=FALSE",
[IPE_PROP_BOOT_VERIFIED_TRUE] = "boot_verified=TRUE",
[IPE_PROP_DMV_ROOTHASH] = "dmverity_roothash=",
[IPE_PROP_DMV_SIG_FALSE] = "dmverity_signature=FALSE",
[IPE_PROP_DMV_SIG_TRUE] = "dmverity_signature=TRUE",
[IPE_PROP_FSV_DIGEST] = "fsverity_digest=",
[IPE_PROP_FSV_SIG_FALSE] = "fsverity_signature=FALSE",
[IPE_PROP_FSV_SIG_TRUE] = "fsverity_signature=TRUE",
};
/**
@ -262,18 +262,10 @@ void ipe_audit_policy_load(const struct ipe_policy *const p)
*/
void ipe_audit_enforce(bool new_enforce, bool old_enforce)
{
struct audit_buffer *ab;
ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS);
if (!ab)
return;
audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
"enforcing=%d old_enforcing=%d auid=%u ses=%u"
" enabled=1 old-enabled=1 lsm=ipe res=1",
new_enforce, old_enforce,
from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current));
audit_log_end(ab);
}

2
security/ipe/policy.c
View File

@ -52,7 +52,7 @@ void ipe_free_policy(struct ipe_policy *p)
ipe_del_policyfs_node(p);
ipe_free_parsed_policy(p->parsed);
/*
* p->text is allocated only when p->pkcs7 is not NULL
* p->text is allocated only when p->pkcs7 is NULL
* otherwise it points to the plaintext data inside the pkcs7
*/
if (!p->pkcs7)

10
security/ipe/policy_parser.c
View File

@ -128,6 +128,8 @@ static const match_table_t header_tokens = {
{__IPE_HEADER_MAX, NULL}
};
static_assert(ARRAY_SIZE(header_tokens) == __IPE_HEADER_MAX + 1);
/**
* parse_header() - Parse policy header information.
* @line: Supplies header line to be parsed.
@ -201,7 +203,7 @@ static int parse_header(char *line, struct ipe_parsed_policy *p)
* * %false - The token is not "DEFAULT"
* * %true - The token is "DEFAULT"
*/
static bool token_default(char *token)
static bool token_default(const char *token)
{
return !strcmp(token, "DEFAULT");
}
@ -240,6 +242,8 @@ static const match_table_t operation_tokens = {
{IPE_OP_INVALID, NULL}
};
static_assert(ARRAY_SIZE(operation_tokens) == __IPE_OP_MAX + 1);
/**
* parse_operation() - Parse the operation type given a token string.
* @t: Supplies the token string to be parsed.
@ -259,6 +263,8 @@ static const match_table_t action_tokens = {
{IPE_ACTION_INVALID, NULL}
};
static_assert(ARRAY_SIZE(action_tokens) == __IPE_ACTION_MAX + 1);
/**
* parse_action() - Parse the action type given a token string.
* @t: Supplies the token string to be parsed.
@ -284,6 +290,8 @@ static const match_table_t property_tokens = {
{IPE_PROP_INVALID, NULL}
};
static_assert(ARRAY_SIZE(property_tokens) == __IPE_PROP_MAX + 1);
/**
* parse_property() - Parse a rule property given a token string.
* @t: Supplies the token string to be parsed.