From: Thore Sommer <public@thson.de> To: tusharsu@linux.microsoft.com Cc: agk@redhat.com, dm-devel@redhat.com, linux-integrity@vger.kernel.org, nramas@linux.microsoft.com, public@thson.de, snitzer@redhat.com, zohar@linux.ibm.com Subject: Re: [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Date: Mon, 2 Aug 2021 12:38:23 +0200 [thread overview] Message-ID: <20210802103823.199091-1-public@thson.de> (raw) In-Reply-To: <f73308f3-485f-46cb-0f20-6619edb541e6@linux.microsoft.com> Hi Tushar, thank you for answering my questions and looking at my suggestions. > I can update the verity_status() to measure if v->signature_key_desc is > set. > > Something like: > DMEMIT("signature_key_desc_present=%c,", v->signature_key_desc ? 'y' : > 'n'); If my understanding that this entry is only set if the signature was validated is correct then this should work. > Please note – even if we measure signature_key_desc (full string or just > its presence): in order to use it with the keyrings, the IMA policy also > needs to be set to measure key rings (using "measure func=KEY_CHECK > ..."). It is independent from measuring the device mapper data (which is > measured when the policy is set to “measure func=CRITICAL_DATA > label=device-mapper ..."). > > Therefore measuring keyrings together (i.e. in the same IMA log) with DM > data is not always guaranteed, since it is dictated by how the IMA > policy is configured. Thanks for pointing that out. Currently we don't measure the keyrings but when we enable remote attestation for dm-verity we'll make sure that our IMA policy also measures the keyrings. Regards, Thore
WARNING: multiple messages have this Message-ID (diff)
From: Thore Sommer <public@thson.de> To: tusharsu@linux.microsoft.com Cc: snitzer@redhat.com, zohar@linux.ibm.com, nramas@linux.microsoft.com, dm-devel@redhat.com, public@thson.de, linux-integrity@vger.kernel.org, agk@redhat.com Subject: Re: [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Date: Mon, 2 Aug 2021 12:38:23 +0200 [thread overview] Message-ID: <20210802103823.199091-1-public@thson.de> (raw) In-Reply-To: <f73308f3-485f-46cb-0f20-6619edb541e6@linux.microsoft.com> Hi Tushar, thank you for answering my questions and looking at my suggestions. > I can update the verity_status() to measure if v->signature_key_desc is > set. > > Something like: > DMEMIT("signature_key_desc_present=%c,", v->signature_key_desc ? 'y' : > 'n'); If my understanding that this entry is only set if the signature was validated is correct then this should work. > Please note – even if we measure signature_key_desc (full string or just > its presence): in order to use it with the keyrings, the IMA policy also > needs to be set to measure key rings (using "measure func=KEY_CHECK > ..."). It is independent from measuring the device mapper data (which is > measured when the policy is set to “measure func=CRITICAL_DATA > label=device-mapper ..."). > > Therefore measuring keyrings together (i.e. in the same IMA log) with DM > data is not always guaranteed, since it is dictated by how the IMA > policy is configured. Thanks for pointing that out. Currently we don't measure the keyrings but when we enable remote attestation for dm-verity we'll make sure that our IMA policy also measures the keyrings. Regards, Thore -- dm-devel mailing list dm-devel@redhat.com https://listman.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2021-08-02 10:38 UTC|newest] Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-07-13 0:48 [PATCH 0/7] device mapper target measurements using IMA Tushar Sugandhi 2021-07-13 0:48 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:48 ` [PATCH 1/7] dm: measure data on table load Tushar Sugandhi 2021-07-13 0:48 ` [dm-devel] " Tushar Sugandhi 2021-07-21 2:12 ` Mimi Zohar 2021-07-21 2:12 ` [dm-devel] " Mimi Zohar 2021-07-21 15:42 ` Mike Snitzer 2021-07-21 15:42 ` [dm-devel] " Mike Snitzer 2021-07-21 16:07 ` Mimi Zohar 2021-07-21 16:07 ` [dm-devel] " Mimi Zohar 2021-07-21 21:17 ` Mimi Zohar 2021-07-21 21:17 ` [dm-devel] " Mimi Zohar 2021-07-29 19:58 ` Tushar Sugandhi 2021-07-29 19:58 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:48 ` [PATCH 2/7] dm: measure data on device resume Tushar Sugandhi 2021-07-13 0:48 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 3/7] dm: measure data on device remove Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 4/7] dm: measure data on table clear Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 5/7] dm: measure data on device rename Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 6/7] dm: update target specific status functions to measure data Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 1:06 ` Alasdair G Kergon 2021-07-13 1:06 ` [dm-devel] " Alasdair G Kergon 2021-07-14 20:23 ` Tushar Sugandhi 2021-07-14 20:23 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 7/7] dm: add documentation for IMA measurement support Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-21 2:33 ` Mimi Zohar 2021-07-21 2:33 ` [dm-devel] " Mimi Zohar 2021-07-24 7:25 ` Tushar Sugandhi 2021-07-24 7:25 ` [dm-devel] " Tushar Sugandhi 2021-07-26 16:33 ` Mimi Zohar 2021-07-26 16:33 ` [dm-devel] " Mimi Zohar 2021-07-26 18:28 ` Tushar Sugandhi 2021-07-26 18:28 ` [dm-devel] " Tushar Sugandhi 2021-07-14 11:32 ` [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Thore Sommer 2021-07-14 11:32 ` Thore Sommer 2021-07-14 20:20 ` Tushar Sugandhi 2021-07-14 20:20 ` Tushar Sugandhi 2021-07-27 10:18 ` Thore Sommer 2021-07-27 10:18 ` Thore Sommer 2021-07-27 20:33 ` Alasdair G Kergon 2021-07-27 20:33 ` Alasdair G Kergon 2021-07-28 3:10 ` Tushar Sugandhi 2021-07-28 3:10 ` Tushar Sugandhi 2021-07-28 17:14 ` Thore Sommer 2021-07-28 17:14 ` Thore Sommer 2021-07-29 17:32 ` Tushar Sugandhi 2021-07-29 17:32 ` Tushar Sugandhi 2021-07-28 17:34 ` Thore Sommer 2021-07-28 17:34 ` Thore Sommer 2021-07-28 21:33 ` Alasdair G Kergon 2021-07-28 21:33 ` Alasdair G Kergon 2021-08-02 10:45 ` Thore Sommer 2021-08-02 10:45 ` Thore Sommer 2021-07-29 19:24 ` Tushar Sugandhi 2021-07-29 19:24 ` Tushar Sugandhi 2021-08-02 10:38 ` Thore Sommer [this message] 2021-08-02 10:38 ` Thore Sommer 2021-07-20 21:27 ` Mike Snitzer 2021-07-20 21:27 ` [dm-devel] " Mike Snitzer 2021-07-24 6:57 ` Tushar Sugandhi
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210802103823.199091-1-public@thson.de \ --to=public@thson.de \ --cc=agk@redhat.com \ --cc=dm-devel@redhat.com \ --cc=linux-integrity@vger.kernel.org \ --cc=nramas@linux.microsoft.com \ --cc=snitzer@redhat.com \ --cc=tusharsu@linux.microsoft.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.