Re: [PATCH v3 0/2] ima/evm fixes for v5.2

From: Janne Karhunen <janne.karhunen@gmail.com>
To: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>,
	dmitry.kasatkin@huawei.com, mjg59@google.com,
	linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	silviu.vlasceanu@huawei.com
Subject: Re: [PATCH v3 0/2] ima/evm fixes for v5.2
Date: Wed, 12 Jun 2019 14:28:30 +0300	[thread overview]
Message-ID: <CAE=NcraYOw9B3RFu3_DbJs9nPT87AtQEptC7zF4kAu4FP8YhxA@mail.gmail.com> (raw)
In-Reply-To: <20190606112620.26488-1-roberto.sassu@huawei.com>

On Thu, Jun 6, 2019 at 3:27 PM Roberto Sassu <roberto.sassu@huawei.com> wrote:
>
> Previous versions included the patch 'ima: don't ignore INTEGRITY_UNKNOWN
> EVM status'. However, I realized that this patch cannot be accepted alone
> because IMA-Appraisal would deny access to new files created during the
> boot.

The early initialization logic seems to have been changing, the
original one as I have understood it:
- before initialization
  - allow reading anything without security.ima
  - deny reading anything with security.ima
  - allow all writes
- after initialization
  - deny reading|writing anything without security.ima
  - deny reading|writing anything invalid
  - allow everything else

The logic is pretty handy as it even creates additional layer of
security around the early initialization files as they become
unreadable after use.

Now, if we initialize the system with a random key like in your patch,
this logic is to change quite drastically? It sounds to me the
userland may actually break, all the userland initialization files in
the existing ima configurations that do not use digsigs would become
unreadable given that the random key is put in? Remember, those files
can be protected via other means (most commonly signed ramdisk).

--
Janne