Add privilege dropping for push model agent#1162
Merged
sergio-correia merged 5 commits intokeylime:masterfrom Dec 10, 2025
Merged
Add privilege dropping for push model agent#1162sergio-correia merged 5 commits intokeylime:masterfrom
sergio-correia merged 5 commits intokeylime:masterfrom
Conversation
The run_as() function had an incorrect order of operations when dropping privileges, violating the security requirements specified in POS36-C and potentially leaving the process with unintended supplementary group privileges. Previous (incorrect) order: 1. setgid() - Set GID 2. getgrouplist() - Get supplementary groups 3. setgroups() - Set supplementary groups 4. setuid() - Set UID This order is unsafe because if setgroups() fails after setgid() succeeds, the process retains supplementary group memberships from the root user, potentially granting unintended privileges. Corrected order (per POS36-C and CWE-696): 1. getgrouplist() - Get supplementary groups (while still root) 2. setgroups() - Drop supplementary groups FIRST 3. setgid() - Set GID SECOND 4. setuid() - Set UID LAST (irreversible) This ensures that supplementary groups are cleared before changing the primary GID, preventing privilege retention on error. References: - CERT C Secure Coding Standard: POS36-C - CWE-696: Incorrect Behavior Order Assisted-by: Claude 4 Sonnet Signed-off-by: Sergio Correia <scorreia@redhat.com>
… model agent This commit adds the infrastructure for proper privilege dropping in the push model agent to match the security model of the pull model agent. Changes: - Add new privileged_resources module to handle root-required operations - Open IMA and measured boot logs early in main() before dropping privileges - Implement privilege dropping logic based on run_as config option - Add comprehensive tests for privileged resource initialization The privileged resources (IMA/measured boot log files) require root access to /sys/kernel/security/. After opening these files, the agent drops privileges to the configured user:group (default: keylime:keylime). TPM access after privilege drop is provided via group membership (typically the tss group). The file handles are opened but not yet used by the attestation code. Subsequent commits will thread these resources through the call chain. Assisted-by: Claude 4 Sonnet Signed-off-by: Sergio Correia <scorreia@redhat.com>
This commit threads PrivilegedResources through the attestation flow and implements stateful IMA log reading using MeasurementList, ensuring IMA evidence is available after privilege dropping. - IMA evidence available after privilege dropping (uses pre-opened file handles) - Stateful reading: only processes new entries since last read - Avoids seeking issues on virtual filesystems (securityfs) - More efficient than re-reading entire log each time - Same proven approach as pull model agent Assisted-by: Claude 4 Sonnet Signed-off-by: Sergio Correia <scorreia@redhat.com>
…gent The push model agent previously had hardcoded CLI argument defaults for verifier TLS certificates that ignored the KEYLIME_DIR environment variable. This change adds proper KEYLIME_DIR support by introducing new config options that follow the same pattern used for registrar TLS certificates. Changes: - Add verifier_tls_ca_cert, verifier_tls_client_cert, and verifier_tls_client_key config fields - Make push model agent CLI args optional and use config values as defaults - Update keylime-agent.conf with documentation for new options - Path resolution now respects KEYLIME_DIR for verifier certificates Backward compatibility: - CLI arguments continue to work and override config values - Without KEYLIME_DIR, paths resolve to /var/lib/keylime/cv_ca/* (same as before) - With KEYLIME_DIR, paths resolve to $KEYLIME_DIR/cv_ca/* (new capability) Assisted-by: Claude 4.5 Sonnet Signed-off-by: Sergio Correia <scorreia@redhat.com>
Signed-off-by: Sergio Correia <scorreia@redhat.com>
sergio-correia
force-pushed
the
run-as
branch
from
cc1848b to
2c430d3
Compare
34 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR implements privilege dropping support and related security enhancements for push model agent.
Fixes #1157