Re: [PATCH v3 0/2] ima/evm fixes for v5.2

From: Janne Karhunen <janne.karhunen@gmail.com>
To: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>,
	dmitry.kasatkin@huawei.com, mjg59@google.com,
	linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	silviu.vlasceanu@huawei.com
Subject: Re: [PATCH v3 0/2] ima/evm fixes for v5.2
Date: Thu, 13 Jun 2019 10:39:51 +0300	[thread overview]
Message-ID: <CAE=NcrZgQSENPOtRdU=u1y6kqy0ouaaj-gioKHaUxZUcbUHwqA@mail.gmail.com> (raw)
In-Reply-To: <144bf319-ea0c-f6b6-5737-0aac34f37186@huawei.com>

On Thu, Jun 13, 2019 at 9:57 AM Roberto Sassu <roberto.sassu@huawei.com> wrote:

> > Ok, I see the use case. Now, if you pull a urandom key that early on
> > during the boot, the state of the system entropy is at all time low,
> > and you are not really protecting against any sort of offline attack
> > since the file is created during that boot cycle. Is there really use
> > for using such key? Wouldn't it be possible to create a new config
> > option, say IMA_ALLOW_EARLY_WRITERS, that would hold the NEW_FILE flag
> > until the persistent key becomes available? In other words, it would
> > start the measuring at the point when the key becomes online?
>
> I also thought about similar solutions. Another is for example to keep
> the appraisal flags at file close, if security.ima is successfully
> added to the file.
>
> Initializing EVM with a key is not a trivial change, but it seemed
> better to me as it does not introduce exceptions in the IMA behavior.

Would the appraise actually need any changes, just keep the
IMA_NEW_FILE in ima_check_last_writer()? Of course it's not that easy
(it never is) as the iint could go away and things like that, but with
some tweaks?

--
Janne