linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Roberto Sassu <roberto.sassu@huawei.com>, mjg59@srcf.ucam.org
Cc: linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org, linux-doc@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 6/7] ima: Introduce template field evmxattrs
Date: Mon, 24 May 2021 14:31:38 -0400	[thread overview]
Message-ID: <34c6aee39110d163c41670b1b6b309288d9986c4.camel@linux.ibm.com> (raw)
In-Reply-To: <20210520085701.465369-7-roberto.sassu@huawei.com>

Hi Roberto,

On Thu, 2021-05-20 at 10:57 +0200, Roberto Sassu wrote:
> This patch introduces the new template field evmxattrs, which contains the
> number of EVM protected xattrs (u32 in little endian), the xattr names
> separated by \0, the xattr lengths (u32 in little endian) and the xattr
> values. Xattrs can be used to verify the EVM portable signature, if it was
> included with the template fields sig or evmsig.

Verifying the file data hash and the template data hash, the value
extended into the TPM,  are straight forward.  In the first case all
that is needed is the public key, and in the other case the length of
the template data.  Verifying the template data hash doesn't require
any knowledge of the template data format.   All that is needed is the
length of the template data.

This patch set provides all the necessary information for verifying the
EVM portable signature, but it is so much more difficult.  For example,
the security xattrs are listed in whatever order listxattr returns, not
the order in which the hash is calculated.  Does the attestation server
really need to know which xattrs are included or their length?  If that
information is important for the attestation server, then perhaps
provide it separately from the xattrs data.

I'm thinking the attestation server just needs the ability of verifying
the EVM portable signature.   As each field is prefixed with the field
data length, the attestation server should be able to re-calculate the
expected hash - xattrs, followed by the individual "misc" data fields.

thanks,

Mimi


  reply	other threads:[~2021-05-24 18:31 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-20  8:56 [PATCH 0/7] ima: Add template fields to verify EVM portable signatures Roberto Sassu
2021-05-20  8:56 ` [PATCH 1/7] ima: Add ima_show_template_uint() template library function Roberto Sassu
2021-05-20  8:56 ` [PATCH 2/7] ima: Introduce template fields iuid and igid Roberto Sassu
2021-05-20  8:56 ` [PATCH 3/7] ima: Introduce template fields mntuidmap and mntgidmap Roberto Sassu
2021-05-20  9:36   ` Christian Brauner
2021-05-20  9:41     ` Christian Brauner
2021-05-20 11:54       ` Roberto Sassu
2021-05-20  8:56 ` [PATCH 4/7] ima: Introduce template field imode Roberto Sassu
2021-05-20  8:56 ` [PATCH 5/7] evm: Verify portable signatures against all protected xattrs Roberto Sassu
2021-05-24 18:21   ` Mimi Zohar
2021-05-20  8:57 ` [PATCH 6/7] ima: Introduce template field evmxattrs Roberto Sassu
2021-05-24 18:31   ` Mimi Zohar [this message]
2021-05-20  8:57 ` [PATCH 7/7] evm: Don't return an error in evm_write_xattrs() if audit is not enabled Roberto Sassu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=34c6aee39110d163c41670b1b6b309288d9986c4.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mjg59@srcf.ucam.org \
    --cc=roberto.sassu@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).