* Immutable metadata
@ 2020-03-28 11:18 Roberto Sassu
2020-03-30 2:10 ` Mimi Zohar
0 siblings, 1 reply; 6+ messages in thread
From: Roberto Sassu @ 2020-03-28 11:18 UTC (permalink / raw)
To: matthewgarrett, Mimi Zohar; +Cc: linux-integrity, Silviu Vlasceanu
Hi Matthew, Mimi
I have a question about portable signatures. Is there any particular reason
why a write to a file is not denied by IMA if metadata are immutable?
Thanks
Roberto
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Li Jian, Shi Yanli
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Immutable metadata
2020-03-28 11:18 Immutable metadata Roberto Sassu
@ 2020-03-30 2:10 ` Mimi Zohar
2020-03-30 15:46 ` Mimi Zohar
0 siblings, 1 reply; 6+ messages in thread
From: Mimi Zohar @ 2020-03-30 2:10 UTC (permalink / raw)
To: Roberto Sassu, matthewgarrett; +Cc: linux-integrity, Silviu Vlasceanu
Hi Roberto,
On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote:
> Hi Matthew, Mimi
>
> I have a question about portable signatures. Is there any particular reason
> why a write to a file is not denied by IMA if metadata are immutable?
As much as possible, IMA and EVM should be independent of each other.
EVM is responsible for the integrity of file metadata, so it needs to
read other security xattrs, but IMA shouldn't be looking at the EVM
xattr.
Like any other security xattr, responsibility for maintaining the
xattr is left up to the particular LSM. In this case, EVM would need
to prevent the file from being opened rw. Should that be hard coded
or based on an EVM policy?
Mimi
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Immutable metadata
2020-03-30 2:10 ` Mimi Zohar
@ 2020-03-30 15:46 ` Mimi Zohar
2020-03-30 15:56 ` Roberto Sassu
0 siblings, 1 reply; 6+ messages in thread
From: Mimi Zohar @ 2020-03-30 15:46 UTC (permalink / raw)
To: Roberto Sassu, matthewgarrett; +Cc: linux-integrity, Silviu Vlasceanu
On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote:
> Hi Roberto,
>
> On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote:
> > Hi Matthew, Mimi
> >
> > I have a question about portable signatures. Is there any particular reason
> > why a write to a file is not denied by IMA if metadata are immutable?
>
> As much as possible, IMA and EVM should be independent of each other.
> EVM is responsible for the integrity of file metadata, so it needs to
> read other security xattrs, but IMA shouldn't be looking at the EVM
> xattr.
>
> Like any other security xattr, responsibility for maintaining the
> xattr is left up to the particular LSM. In this case, EVM would need
> to prevent the file from being opened rw. Should that be hard coded
> or based on an EVM policy?
Thinking about this a bit more, evm_verifyxattr() is already returning
INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based on
it.
Mimi
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Immutable metadata
2020-03-30 15:46 ` Mimi Zohar
@ 2020-03-30 15:56 ` Roberto Sassu
2020-03-30 18:36 ` Mimi Zohar
0 siblings, 1 reply; 6+ messages in thread
From: Roberto Sassu @ 2020-03-30 15:56 UTC (permalink / raw)
To: Mimi Zohar, matthewgarrett; +Cc: linux-integrity, Silviu Vlasceanu
> -----Original Message-----
> From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> Sent: Monday, March 30, 2020 5:47 PM
> To: Roberto Sassu <roberto.sassu@huawei.com>;
> matthewgarrett@google.com
> Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu
> <Silviu.Vlasceanu@huawei.com>
> Subject: Re: Immutable metadata
>
> On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote:
> > Hi Roberto,
> >
> > On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote:
> > > Hi Matthew, Mimi
> > >
> > > I have a question about portable signatures. Is there any particular
> reason
> > > why a write to a file is not denied by IMA if metadata are immutable?
> >
> > As much as possible, IMA and EVM should be independent of each other.
> > EVM is responsible for the integrity of file metadata, so it needs to
> > read other security xattrs, but IMA shouldn't be looking at the EVM
> > xattr.
> >
> > Like any other security xattr, responsibility for maintaining the
> > xattr is left up to the particular LSM. In this case, EVM would need
> > to prevent the file from being opened rw. Should that be hard coded
> > or based on an EVM policy?
>
> Thinking about this a bit more, evm_verifyxattr() is already returning
> INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based on
> it.
Yes, this was the idea.
I would say also that files with portable signatures fulfill the appraise_type=imasig
requirement. I would set the IMA_DIGSIG bit in iint->atomic_flags. Is it ok?
Thanks
Roberto
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Li Jian, Shi Yanli
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Immutable metadata
2020-03-30 15:56 ` Roberto Sassu
@ 2020-03-30 18:36 ` Mimi Zohar
2020-03-31 6:56 ` Roberto Sassu
0 siblings, 1 reply; 6+ messages in thread
From: Mimi Zohar @ 2020-03-30 18:36 UTC (permalink / raw)
To: Roberto Sassu, matthewgarrett; +Cc: linux-integrity, Silviu Vlasceanu
On Mon, 2020-03-30 at 15:56 +0000, Roberto Sassu wrote:
> > -----Original Message-----
> > From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> > Sent: Monday, March 30, 2020 5:47 PM
> > To: Roberto Sassu <roberto.sassu@huawei.com>;
> > matthewgarrett@google.com
> > Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu
> > <Silviu.Vlasceanu@huawei.com>
> > Subject: Re: Immutable metadata
> >
> > On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote:
> > > Hi Roberto,
> > >
> > > On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote:
> > > > Hi Matthew, Mimi
> > > >
> > > > I have a question about portable signatures. Is there any particular
> > reason
> > > > why a write to a file is not denied by IMA if metadata are immutable?
> > >
> > > As much as possible, IMA and EVM should be independent of each other.
> > > EVM is responsible for the integrity of file metadata, so it needs to
> > > read other security xattrs, but IMA shouldn't be looking at the EVM
> > > xattr.
> > >
> > > Like any other security xattr, responsibility for maintaining the
> > > xattr is left up to the particular LSM. In this case, EVM would need
> > > to prevent the file from being opened rw. Should that be hard coded
> > > or based on an EVM policy?
> >
> > Thinking about this a bit more, evm_verifyxattr() is already returning
> > INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based on
> > it.
>
> Yes, this was the idea.
>
> I would say also that files with portable signatures fulfill the appraise_type=imasig
> requirement. I would set the IMA_DIGSIG bit in iint->atomic_flags. Is it ok?
Ok, so locking doesn't seem to be an issue here. I'm not sure about
re-using the existing bit. EVM_XATTR_PORTABLE_DIGSIG is dependent on
the existence of a file hash. The existing bit prevents calculating
and writing the file hash as an xattr. Would this affect installing
new files?
Mimi
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Immutable metadata
2020-03-30 18:36 ` Mimi Zohar
@ 2020-03-31 6:56 ` Roberto Sassu
0 siblings, 0 replies; 6+ messages in thread
From: Roberto Sassu @ 2020-03-31 6:56 UTC (permalink / raw)
To: Mimi Zohar, matthewgarrett; +Cc: linux-integrity, Silviu Vlasceanu
> -----Original Message-----
> From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> Sent: Monday, March 30, 2020 8:37 PM
> To: Roberto Sassu <roberto.sassu@huawei.com>;
> matthewgarrett@google.com
> Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu
> <Silviu.Vlasceanu@huawei.com>
> Subject: Re: Immutable metadata
>
> On Mon, 2020-03-30 at 15:56 +0000, Roberto Sassu wrote:
> > > -----Original Message-----
> > > From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> > > Sent: Monday, March 30, 2020 5:47 PM
> > > To: Roberto Sassu <roberto.sassu@huawei.com>;
> > > matthewgarrett@google.com
> > > Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu
> > > <Silviu.Vlasceanu@huawei.com>
> > > Subject: Re: Immutable metadata
> > >
> > > On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote:
> > > > Hi Roberto,
> > > >
> > > > On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote:
> > > > > Hi Matthew, Mimi
> > > > >
> > > > > I have a question about portable signatures. Is there any particular
> > > reason
> > > > > why a write to a file is not denied by IMA if metadata are immutable?
> > > >
> > > > As much as possible, IMA and EVM should be independent of each
> other.
> > > > EVM is responsible for the integrity of file metadata, so it needs to
> > > > read other security xattrs, but IMA shouldn't be looking at the EVM
> > > > xattr.
> > > >
> > > > Like any other security xattr, responsibility for maintaining the
> > > > xattr is left up to the particular LSM. In this case, EVM would need
> > > > to prevent the file from being opened rw. Should that be hard coded
> > > > or based on an EVM policy?
> > >
> > > Thinking about this a bit more, evm_verifyxattr() is already returning
> > > INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based
> on
> > > it.
> >
> > Yes, this was the idea.
> >
> > I would say also that files with portable signatures fulfill the
> appraise_type=imasig
> > requirement. I would set the IMA_DIGSIG bit in iint->atomic_flags. Is it ok?
>
> Ok, so locking doesn't seem to be an issue here. I'm not sure about
> re-using the existing bit. EVM_XATTR_PORTABLE_DIGSIG is dependent on
> the existence of a file hash. The existing bit prevents calculating
> and writing the file hash as an xattr. Would this affect installing
> new files?
Since it is a portable signature, security.ima is known in advance. IMA ability
to update security.ima is not necessary in this case. security.ima will be set
by user space tools.
Currently, there is still the issue of adding all xattrs to a file when EVM is
enforcing (it refuses to copy all xattrs, as the integrity of the partial set cannot
be verified). I will address this later.
Roberto
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Li Jian, Shi Yanli
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-03-31 6:56 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-28 11:18 Immutable metadata Roberto Sassu
2020-03-30 2:10 ` Mimi Zohar
2020-03-30 15:46 ` Mimi Zohar
2020-03-30 15:56 ` Roberto Sassu
2020-03-30 18:36 ` Mimi Zohar
2020-03-31 6:56 ` Roberto Sassu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.