Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3]

[David Howells <dhowells@redhat.com>]

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> > The third option I've added is that you can't add to .ima at all.  You only
> > get what's included at build time.  You don't want that option?
> 
> Adding keys directly to the IMA keyring is a new feature.  There's enough
> changes as it is, that this patch should be limited to replicating existing
> usage, not adding new features.

The three choice options I implemented don't exactly provide new features.
Firstly:

	config IMA_LOAD_X509

allow keys to be loaded in at compile time, secondly,

	config INTEGRITY_SIGNATURE

allows keys to be inserted whilst the kernel is running if those keys are
"trusted", and, thirdly,

	config IMA_MOK_KEYRING

modifies what it means for a key to be "trusted" by allowing intermediate
levels of CA certificates to be chained.


So, of the three choice options I'm providing,

	config IMA_KEYRINGS_ADD_IF_SIGNED_BY_BUILTIN

is equivalent to setting INTEGRITY_SIGNATURE plus IMA_LOAD_X509 if you set it;
then

	config IMA_KEYRINGS_ADD_IF_SIGNED_BY_BUILTIN_OR_SECONDARY

is the equivalent of turning on IMA_MOK_KEYRING as well.

Fair enough, you can argue that:

	config IMA_KEYRINGS_COMPILE_LOAD_ONLY

allowing you to disable addition of keys whilst the kernel is running is a
'new feature'.  I disagree, I think it should be there for completeness.

> > > > +config IMA_KEYRINGS_COMPILE_LOAD_ONLY
> > > > +	bool "No runtime key addition"
> > > ...
> > > This could be useful for namespacing IMA. 
> > 
> > You said you didn't want this option above (to quote: In this patch, the
> > choice should be between checking just the builtin trusted keys or both the
> > builtin trusted and secondary keys.)
> 
> Does the ability of adding builtin X.509 certificates directly to the
> IMA keyring already exist or is it something that still needs to be
> done?   Assuming the latter, this option would be added with the ability
> of adding X.509 certificates directly to the IMA keyring.

I don't know what you mean by "directly" here.  Even without this patch, you
can already add X.509 certs to the .ima keyring, both at compile time and at
runtime.  This patch doesn't take that away - except by explicitly setting the
option to prevent runtime addition.

David