Enforce RPM SHA256 floor during trust lookup

rpm_sha256_only only filtered RPM trust data while it was imported. If a weak RPM digest was already present in the active LMDB trust database, digest-based integrity lookup could still evaluate that stale SHA1 or MD5 record after the option was enabled.

Snapshot rpm_sha256_only into the immutable decision config and have trust lookup skip sub-SHA256 records for SHA256 and IMA integrity modes when the floor is active. SHA1/MD5 RPM records remain usable when rpm_sha256_only is disabled, and strict mode can still trust a SHA256-or-stronger duplicate for the same path.

Add decision-config coverage for the new pinned field and an LMDB regression that imports a SHA1 RPM record, verifies compatibility-mode trust, verifies strict-mode rejection without rebuilding the DB, and verifies trust again after adding a SHA256 duplicate. Update the manpage to document the ingestion and lookup-side behavior.

Author: stevegrubb

doc/fapolicyd.conf.5

@@ -154,7 +154,17 @@ Example:
 
 .TP
 .B rpm_sha256_only
-When this option is set to 1, it will force the daemon to work only with SHA256 and larger hashes. This is useful on the systems where the integrity is set to SHA256 or IMA and some rpms were originally built with e.g. SHA1. The daemon will ignore these SHA1 entries. If set to 0 the daemon stores SHA1/MD5 in trustdb as well. This is compatible with older behavior which works with the integrity set to NONE and SIZE. The NONE or SIZE integrity setting considers the files installed via rpm as trusted and it does not care about their hashes at all. On the other hand the integrity set to SHA256 or IMA will never consider a file with SHA1 in trustdb as trusted. The default value is 0.
+When this option is set to 1, it will force RPM trust entries to use SHA256
+or larger hashes. This is useful on systems where the integrity is set to
+SHA256 or IMA and some rpms were originally built with e.g. SHA1. The daemon
+will ignore these SHA1 entries when the RPM backend imports trust data. Hash
+integrity lookups also reject SHA1/MD5 records that are already present in the
+active trust database, so stale weak RPM entries do not remain trusted after a
+configuration reload enables this option. If set to 0 the daemon stores and
+uses SHA1/MD5 from RPM trust data as well. This is compatible with older
+behavior which works with the integrity set to NONE and SIZE. The NONE or SIZE
+integrity setting considers the files installed via rpm as trusted and it does
+not care about their hashes at all. The default value is 0.
 
 .TP
 .B allow_filesystem_mark
@@ -239,17 +249,18 @@ The following
 settings are live after a successful reload:
 .RS
 .IP \[bu] 2
-\fBpermissive\fP and \fBintegrity\fP are decision-used fields and are
-published together as one immutable generation.
+\fBpermissive\fP, \fBintegrity\fP, and the lookup-side
+\fBrpm_sha256_only\fP digest floor are decision-used fields and are published
+together as one immutable generation.
 .IP \[bu]
 \fBnice_val\fP, \fBdo_stat_report\fP, \fBdetailed_report\fP,
 \fBreset_strategy\fP, and \fBtiming_collection\fP are applied directly by the
 reload path.
 .IP \[bu]
 \fBsyslog_format\fP is used by the next successfully published ruleset.
 .IP \[bu]
-\fBtrust\fP and \fBrpm_sha256_only\fP are used by the next trust database
-reload.
+\fBtrust\fP and the \fBrpm_sha256_only\fP RPM ingestion filter are used by the
+next trust database reload.
 .RE
 .PP
 The

src/library/database.c

@@ -4748,6 +4748,7 @@ static int read_trust_db(struct trust_db_read_handle *read,
 {
 	int do_integrity = 0, mode = READ_TEST_KEY;
 	integrity_t integrity = decision_config_integrity(NULL);
+	unsigned int rpm_sha256_only = decision_config_rpm_sha256_only(NULL);
 	char *res;
 	int retry = 0;
 	char sha_xattr[FILE_DIGEST_STRING_MAX];
@@ -4757,11 +4758,16 @@ static int read_trust_db(struct trust_db_read_handle *read,
 	struct file_info *info = lookup->info;
 	int fd = lookup->fd;
 	int *error = lookup->error;
+	file_hash_alg_t calc_alg = FILE_HASH_ALG_NONE;
+	file_hash_alg_t ima_alg = FILE_HASH_ALG_NONE;
+	int have_ima_hash = 0;
+	int ima_rehash_attempted = 0;
 
 	if (integrity != IN_NONE && info) {
 		do_integrity = 1;
 		mode = READ_DATA;
 		sha_xattr[0] = 0; // Make sure we can't re-use stack value
+		calc_digest[0] = 0;
 	}
 
 retry_res:
@@ -4801,6 +4807,17 @@ static int read_trust_db(struct trust_db_read_handle *read,
 		// prepare for next reading
 		mode = READ_DATA_DUP;
 
+		/*
+		 * rpm_sha256_only is enforced during RPM ingestion, but a stale
+		 * LMDB generation can still contain old SHA1/MD5 records after
+		 * a config change or failed rebuild.  Digest-based integrity
+		 * modes must not trust those records when the floor is enabled.
+		 */
+		if (rpm_sha256_only &&
+		    (integrity == IN_SHA256 || integrity == IN_IMA) &&
+		    file_hash_length(record.alg) < SHA256_LEN)
+			goto retry_res;
+
 		if (integrity == IN_SIZE) {
 
 			// match!
@@ -4813,23 +4830,29 @@ static int read_trust_db(struct trust_db_read_handle *read,
 		} else if (integrity == IN_IMA) {
 			int rc = 1;
 			char *hash = NULL;
-			file_hash_alg_t ima_alg = FILE_HASH_ALG_NONE;
 
-			// read xattr only the first time
-			if (retry == 1)
+			// read xattr only once, even when weak records are skipped
+			if (!have_ima_hash) {
 				rc = get_ima_hash(fd, &ima_alg, sha_xattr);
+				if (rc)
+					have_ima_hash = 1;
+			}
 
-			if (rc) {
-				if ((record.size == info->size) &&
-				(strcmp(record.digest,
-				sha_xattr) == 0)) {
-					file_info_cache_digest(info, ima_alg);
-					strncpy(info->digest, sha_xattr,
-						FILE_DIGEST_STRING_MAX-1);
-					info->digest[FILE_DIGEST_STRING_MAX-1]=0;
-					return 1;
-				} else if (retry == 1 &&
-						ima_alg != FILE_HASH_ALG_NONE) {
+			if (!have_ima_hash) {
+				*error = 1;
+				return 0;
+			}
+
+			if ((record.size == info->size) &&
+			    (strcmp(record.digest, sha_xattr) == 0)) {
+				file_info_cache_digest(info, ima_alg);
+				strncpy(info->digest, sha_xattr,
+					FILE_DIGEST_STRING_MAX - 1);
+				info->digest[FILE_DIGEST_STRING_MAX - 1] = 0;
+				return 1;
+			} else if (!ima_rehash_attempted &&
+				   ima_alg != FILE_HASH_ALG_NONE) {
+				ima_rehash_attempted = 1;
 				/*
 				 * Rehash using the IMA algorithm to separate
 				 * metadata drift from content changes. This maps
@@ -4840,30 +4863,25 @@ static int read_trust_db(struct trust_db_read_handle *read,
 				hash = get_hash_from_fd2(fd, info->size, ima_alg);
 				if (hash) {
 					strncpy(calc_digest, hash,
-					FILE_DIGEST_STRING_MAX-1);
-					calc_digest[FILE_DIGEST_STRING_MAX-1]=0;
+						FILE_DIGEST_STRING_MAX - 1);
+					calc_digest[FILE_DIGEST_STRING_MAX - 1] = 0;
 					free(hash);
 					file_info_cache_digest(info, ima_alg);
 					strncpy(info->digest, calc_digest,
-						FILE_DIGEST_STRING_MAX-1);
-					info->digest[FILE_DIGEST_STRING_MAX-1]=0;
+						FILE_DIGEST_STRING_MAX - 1);
+					info->digest[FILE_DIGEST_STRING_MAX - 1] = 0;
 					if ((record.size == info->size) &&
-					(strcmp(record.digest, calc_digest)==0))
+					    (strcmp(record.digest, calc_digest) == 0))
 						return 1;
 				} else {
 					*error = 1;
 					return 0;
 				}
-				}
-
-				log_ima_mismatch(path, record.alg, ima_alg);
-				goto retry_res;
-
-			} else {
-				*error = 1;
-				return 0;
 			}
 
+			log_ima_mismatch(path, record.alg, ima_alg);
+			goto retry_res;
+
 		} else if (integrity == IN_SHA256) {
 			/*
 			 * The name is historical; recomputation follows the
@@ -4875,22 +4893,22 @@ static int read_trust_db(struct trust_db_read_handle *read,
 
 			char *hash = NULL;
 
-			// Calculate a hash only one time
-			if (retry == 1) {
+			// Calculate once per digest algorithm seen in duplicates.
+			if (calc_alg != record.alg) {
 				hash = get_hash_from_fd2(fd, info->size,
 							 record.alg);
 				if (hash) {
 					strncpy(calc_digest, hash,
-						FILE_DIGEST_STRING_MAX-1);
-					calc_digest[FILE_DIGEST_STRING_MAX-1]=0;
+						FILE_DIGEST_STRING_MAX - 1);
+					calc_digest[FILE_DIGEST_STRING_MAX - 1] = 0;
 					if (digest_len < FILE_DIGEST_STRING_MAX)
 						calc_digest[digest_len] = 0;
 					free(hash);
-					file_info_cache_digest(info,
-							       record.alg);
+					file_info_cache_digest(info, record.alg);
 					strncpy(info->digest, calc_digest,
-						FILE_DIGEST_STRING_MAX-1);
-				     info->digest[FILE_DIGEST_STRING_MAX-1] = 0;
+						FILE_DIGEST_STRING_MAX - 1);
+					info->digest[FILE_DIGEST_STRING_MAX - 1] = 0;
+					calc_alg = record.alg;
 				} else {
 					*error = 1;
 					return 0;

src/library/decision-config.c

@@ -24,11 +24,12 @@
  * A permission event pins one generation before event construction and keeps
  * using it through trust checks and the final fanotify response. Reloads
  * publish a new object instead of mutating the active one, so a decision never
- * observes permissive mode from one reload and integrity mode from another.
+ * observes permissive mode from one reload and digest policy from another.
  */
 struct decision_config {
 	unsigned int permissive;
 	integrity_t integrity;
+	unsigned int rpm_sha256_only;
 	unsigned int generation;
 	time_t effective_since;
 	struct decision_config *previous;
@@ -37,6 +38,7 @@ struct decision_config {
 static struct decision_config default_decision_config = {
 	.permissive = 0,
 	.integrity = IN_NONE,
+	.rpm_sha256_only = 0,
 	.generation = 0,
 	.effective_since = 0,
 	.previous = NULL,
@@ -79,6 +81,7 @@ int decision_config_publish(const conf_t *config)
 
 	snapshot->permissive = config->permissive ? 1 : 0;
 	snapshot->integrity = config->integrity;
+	snapshot->rpm_sha256_only = config->rpm_sha256_only ? 1 : 0;
 	now = time(NULL);
 	snapshot->effective_since = now == (time_t)-1 ? 0 : now;
 
@@ -163,6 +166,19 @@ integrity_t decision_config_integrity(const struct decision_config *config)
 	return config->integrity;
 }
 
+/*
+ * decision_config_rpm_sha256_only - return the active RPM digest floor flag.
+ * @config: config generation to inspect, or NULL for the current generation.
+ * Returns 1 when RPM trust records must be SHA256 or stronger, otherwise 0.
+ */
+unsigned int decision_config_rpm_sha256_only(
+	const struct decision_config *config)
+{
+	if (config == NULL)
+		config = decision_config_current();
+	return config->rpm_sha256_only;
+}
+
 unsigned int decision_config_active_generation(void)
 {
 	return decision_config_generation(decision_config_active());

src/library/decision-config.h

@@ -26,6 +26,8 @@ unsigned int decision_config_generation(const struct decision_config *config);
 time_t decision_config_effective_since(const struct decision_config *config);
 unsigned int decision_config_permissive(const struct decision_config *config);
 integrity_t decision_config_integrity(const struct decision_config *config);
+unsigned int decision_config_rpm_sha256_only(
+	const struct decision_config *config);
 unsigned int decision_config_active_generation(void);
 time_t decision_config_active_effective_since(void);
 void decision_config_destroy(void);

src/tests/decision_config_test.c

@@ -40,9 +40,12 @@ int main(void)
 	      "[ERROR:4] pinned permissive mode is wrong");
 	CHECK(decision_config_integrity(pinned) == IN_NONE, 5,
 	      "[ERROR:5] pinned integrity mode is wrong");
+	CHECK(decision_config_rpm_sha256_only(pinned) == 0, 15,
+	      "[ERROR:15] pinned rpm_sha256_only flag is wrong");
 
 	config.permissive = 1;
 	config.integrity = IN_SHA256;
+	config.rpm_sha256_only = 1;
 	CHECK(decision_config_publish(&config) == 0, 6,
 	      "[ERROR:6] second publish failed");
 	second_generation = decision_config_active_generation();
@@ -55,6 +58,8 @@ int main(void)
 	      "[ERROR:9] pinned permissive mode was mutated");
 	CHECK(decision_config_integrity(NULL) == IN_NONE, 10,
 	      "[ERROR:10] pinned integrity mode was mutated");
+	CHECK(decision_config_rpm_sha256_only(NULL) == 0, 16,
+	      "[ERROR:16] pinned rpm_sha256_only flag was mutated");
 
 	decision_config_unpin(pinned);
 	CHECK(decision_config_generation(NULL) == second_generation, 11,
@@ -63,6 +68,8 @@ int main(void)
 	      "[ERROR:12] active permissive mode is wrong");
 	CHECK(decision_config_integrity(NULL) == IN_SHA256, 13,
 	      "[ERROR:13] active integrity mode is wrong");
+	CHECK(decision_config_rpm_sha256_only(NULL) == 1, 17,
+	      "[ERROR:17] active rpm_sha256_only flag is wrong");
 
 	decision_config_destroy();
 	CHECK(decision_config_generation(NULL) == 0, 14,