linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v5 00/12] evm: Improve usability of portable signatures
@ 2021-04-07 10:52 Roberto Sassu
  2021-04-07 10:52 ` [PATCH v5 01/12] evm: Execute evm_inode_init_security() only when an HMAC key is loaded Roberto Sassu
                   ` (11 more replies)
  0 siblings, 12 replies; 40+ messages in thread
From: Roberto Sassu @ 2021-04-07 10:52 UTC (permalink / raw)
  To: zohar, mjg59
  Cc: linux-integrity, linux-security-module, linux-fsdevel,
	linux-kernel, Roberto Sassu

EVM portable signatures are particularly suitable for the protection of
metadata of immutable files where metadata is signed by a software vendor.
They can be used for example in conjunction with an IMA policy that
appraises only executed and memory mapped files.

However, some usability issues are still unsolved, especially when EVM is
used without loading an HMAC key. This patch set attempts to fix the open
issues.

Patch 1 allows EVM to be used without loading an HMAC key. Patch 2 avoids
appraisal verification of public keys (they are already verified by the key
subsystem).

Patches 3-5 allow metadata verification to be turned off when no HMAC key
is loaded and to use this mode in a safe way (by ensuring that IMA
revalidates metadata when there is a change).

Patches 6-9 make portable signatures more usable if metadata verification
is not turned off, by ignoring the INTEGRITY_NOLABEL and INTEGRITY_NOXATTS
errors when possible, by accepting any metadata modification until
signature verification succeeds (useful when xattrs/attrs are copied
sequentially from a source) and by allowing operations that don't change
metadata.

Patch 10 makes it possible to use portable signatures when the IMA policy
requires file signatures and patch 11 shows portable signatures in the
measurement list when the ima-sig template is selected.

Lastly, patch 12 avoids undesired removal of security.ima when a file is
not selected by the IMA policy.

Changelog

v4:
- add patch to pass mnt_userns to EVM inode set/remove xattr hooks
  (suggested by Christian Brauner)
- pass mnt_userns to posix_acl_update_mode()
- use IS_ERR_OR_NULL() in evm_xattr_acl_change() (suggested by Mimi)

v3:
- introduce evm_ignore_error_safe() to correctly ignore INTEGRITY_NOLABEL
  and INTEGRITY_NOXATTRS errors
- fix an error in evm_xattr_acl_change()
- replace #ifndef with !IS_ENABLED() in integrity_load_keys()
- reintroduce ima_inode_removexattr()
- adapt patches to apply on top of the idmapped mounts patch set

v2:
- replace EVM_RESET_STATUS flag with evm_status_revalidate()
- introduce IMA post hooks ima_inode_post_setxattr() and
  ima_inode_post_removexattr()
- remove ima_inode_removexattr()
- ignore INTEGRITY_NOLABEL error if the HMAC key is not loaded

v1:
- introduce EVM_RESET_STATUS integrity flag instead of clearing IMA flag
- introduce new template field evmsig
- add description of evm_xattr_acl_change() and evm_xattr_change()

Roberto Sassu (12):
  evm: Execute evm_inode_init_security() only when an HMAC key is loaded
  evm: Load EVM key in ima_load_x509() to avoid appraisal
  evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded
  ima: Move ima_reset_appraise_flags() call to post hooks
  evm: Introduce evm_status_revalidate()
  evm: Ignore INTEGRITY_NOLABEL/INTEGRITY_NOXATTRS if conditions are
    safe
  evm: Allow xattr/attr operations for portable signatures
  evm: Pass user namespace to set/remove xattr hooks
  evm: Allow setxattr() and setattr() for unmodified metadata
  ima: Allow imasig requirement to be satisfied by EVM portable
    signatures
  ima: Introduce template field evmsig and write to field sig as
    fallback
  ima: Don't remove security.ima if file must not be appraised

 Documentation/ABI/testing/evm             |   5 +-
 Documentation/security/IMA-templates.rst  |   4 +-
 fs/xattr.c                                |   2 +
 include/linux/evm.h                       |  18 +-
 include/linux/ima.h                       |  18 ++
 include/linux/integrity.h                 |   1 +
 security/integrity/evm/evm_main.c         | 216 ++++++++++++++++++++--
 security/integrity/evm/evm_secfs.c        |   4 +-
 security/integrity/iint.c                 |   4 +-
 security/integrity/ima/ima_appraise.c     |  55 ++++--
 security/integrity/ima/ima_init.c         |   4 +
 security/integrity/ima/ima_template.c     |   2 +
 security/integrity/ima/ima_template_lib.c |  33 +++-
 security/integrity/ima/ima_template_lib.h |   2 +
 security/security.c                       |   5 +-
 15 files changed, 329 insertions(+), 44 deletions(-)

-- 
2.26.2


^ permalink raw reply	[flat|nested] 40+ messages in thread

end of thread, other threads:[~2021-05-04 14:50 UTC | newest]

Thread overview: 40+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-07 10:52 [PATCH v5 00/12] evm: Improve usability of portable signatures Roberto Sassu
2021-04-07 10:52 ` [PATCH v5 01/12] evm: Execute evm_inode_init_security() only when an HMAC key is loaded Roberto Sassu
2021-04-07 10:52 ` [PATCH v5 02/12] evm: Load EVM key in ima_load_x509() to avoid appraisal Roberto Sassu
2021-04-07 10:52 ` [PATCH v5 03/12] evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded Roberto Sassu
2021-04-30 20:28   ` Mimi Zohar
2021-04-07 10:52 ` [PATCH v5 04/12] ima: Move ima_reset_appraise_flags() call to post hooks Roberto Sassu
2021-04-07 16:17   ` Casey Schaufler
2021-04-07 16:31     ` Roberto Sassu
2021-04-26 19:49     ` Mimi Zohar
2021-04-07 10:52 ` [PATCH v5 05/12] evm: Introduce evm_status_revalidate() Roberto Sassu
2021-04-07 10:52 ` [PATCH v5 06/12] evm: Ignore INTEGRITY_NOLABEL/INTEGRITY_NOXATTRS if conditions are safe Roberto Sassu
2021-05-03  0:12   ` Mimi Zohar
2021-05-03  7:55     ` Roberto Sassu
2021-05-03 12:07       ` Mimi Zohar
2021-05-03 14:15       ` Roberto Sassu
2021-05-03 14:34         ` Mimi Zohar
2021-05-04 13:16           ` Roberto Sassu
2021-05-04 13:45             ` Mimi Zohar
2021-04-07 10:52 ` [PATCH v5 07/12] evm: Allow xattr/attr operations for portable signatures Roberto Sassu
2021-05-03  0:12   ` Mimi Zohar
2021-05-04 14:28     ` Roberto Sassu
2021-05-04 14:49       ` Mimi Zohar
2021-04-07 10:52 ` [PATCH v5 08/12] evm: Pass user namespace to set/remove xattr hooks Roberto Sassu
2021-04-07 12:06   ` Christian Brauner
2021-04-07 10:52 ` [PATCH v5 09/12] evm: Allow setxattr() and setattr() for unmodified metadata Roberto Sassu
2021-04-07 12:05   ` Christian Brauner
2021-04-07 15:23   ` kernel test robot
2021-04-07 18:14   ` kernel test robot
2021-04-07 19:28     ` [RESEND][PATCH " Roberto Sassu
2021-05-03 13:00   ` [PATCH " Mimi Zohar
2021-05-03 14:48     ` Roberto Sassu
2021-05-03 15:13       ` Mimi Zohar
2021-05-03 15:30         ` Roberto Sassu
2021-05-03 15:11     ` Roberto Sassu
2021-05-03 15:26       ` Mimi Zohar
2021-05-03 15:32         ` Roberto Sassu
2021-05-03 15:48           ` Mimi Zohar
2021-04-07 10:52 ` [PATCH v5 10/12] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2021-04-07 10:52 ` [PATCH v5 11/12] ima: Introduce template field evmsig and write to field sig as fallback Roberto Sassu
2021-04-07 10:52 ` [PATCH v5 12/12] ima: Don't remove security.ima if file must not be appraised Roberto Sassu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).