From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_2 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD431C2BBC7 for ; Tue, 14 Apr 2020 01:11:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 948D9206B6 for ; Tue, 14 Apr 2020 01:11:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728320AbgDNBLq (ORCPT ); Mon, 13 Apr 2020 21:11:46 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:17216 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728066AbgDNBLp (ORCPT ); Mon, 13 Apr 2020 21:11:45 -0400 Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03E144aB115532 for ; Mon, 13 Apr 2020 21:11:43 -0400 Received: from e06smtp04.uk.ibm.com (e06smtp04.uk.ibm.com [195.75.94.100]) by mx0a-001b2d01.pphosted.com with ESMTP id 30cvqestgw-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Apr 2020 21:11:43 -0400 Received: from localhost by e06smtp04.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 14 Apr 2020 02:11:07 +0100 Received: from b06cxnps3075.portsmouth.uk.ibm.com (9.149.109.195) by e06smtp04.uk.ibm.com (192.168.101.134) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 14 Apr 2020 02:11:04 +0100 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 03E1BbiY59244662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Apr 2020 01:11:37 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B1584C040; Tue, 14 Apr 2020 01:11:37 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DB06F4C04A; Tue, 14 Apr 2020 01:11:35 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.203.105]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 14 Apr 2020 01:11:35 +0000 (GMT) Subject: Re: [RFC] IMA: New IMA measurements for dm-crypt and selinux From: Mimi Zohar To: "Lev R. Oshvang ." , Stephen Smalley Cc: Tushar Sugandhi , linux-integrity@vger.kernel.org, LSM List , SELinux , dm-devel@redhat.com, James Morris , chpebeni@linux.microsoft.com, nramas@linux.microsoft.com, balajib@microsoft.com, sashal@kernel.org, suredd@microsoft.com In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Date: Mon, 13 Apr 2020 21:11:19 -0400 Mime-Version: 1.0 X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 20041401-0016-0000-0000-000003040B42 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20041401-0017-0000-0000-00003367FE21 Message-Id: <1586826679.7311.174.camel@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.676 definitions=2020-04-13_11:2020-04-13,2020-04-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 mlxlogscore=999 mlxscore=0 impostorscore=0 adultscore=0 spamscore=0 phishscore=0 clxscore=1015 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004140001 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On Sun, 2020-04-12 at 11:15 +0300, Lev R. Oshvang . wrote: > On Sat, Apr 11, 2020 at 10:07 PM Stephen Smalley > It sees to me that LKRG (kernel run time guard) takes the role of > measuring kernel structures. Perhaps you need to consult with LKRG > guys. There definitely sounds like there is some overlap.  LKRG seems to be measuring kernel structures for enforcing local integrity.  In the context of IMA, measurements are included in the IMA measurement list and used to extend a TPM PCR so that it can be quoted. A generic method for measuring structures and including them in the IMA measurement list sounds interesting. Mimi