Re: [RFC] Persist ima logs to disk

From: Mimi Zohar <zohar@linux.ibm.com>
To: Raphael Gianotti <raphgi@linux.microsoft.com>, janne.karhunen@gmail.com
Cc: linux-integrity@vger.kernel.org, tusharsu@linux.microsoft.com,
	tyhicks@linux.microsoft.com, nramas@linux.microsoft.com,
	balajib@linux.microsoft.com, Amir Goldstein <amir73il@gmail.com>
Subject: Re: [RFC] Persist ima logs to disk
Date: Thu, 07 Jan 2021 10:06:31 -0500	[thread overview]
Message-ID: <87127d502bcb9707dd4e7a43475ab6bed2fdd421.camel@linux.ibm.com> (raw)
In-Reply-To: <20210105195742.2629-1-raphgi@linux.microsoft.com>

[Cc: Amir Goldstein]

On Tue, 2021-01-05 at 11:57 -0800, Raphael Gianotti wrote:
> IMA measures files and buffer data and some systems may end up
> generating lots of entries in the IMA measurement list. This list is
> kept in kernel memoryc and as it grows in size it could end up taking
> too many resources, causing the system to run out of available
> memory. During kexec, the IMA measurement list can be carried over in
> memory, but it's possible for the list to become too large for that
> to happen.
> 
> The Kconfig introduced in this series enables admins to configure a
> maximum number of entries and a file to export the IMA measurement
> list to whenever the set limit is reached.
> 
> The list is written out in append mode, so the system will keep
> writing new entries as long as it stays running or runs out of
> space. Whenever the export file is set, it's truncated. If writing
> to the export list fails, a flag is set to prevent further exports,
> as the file is likely in a bad state. Setting a new export file
> resets this flag, allowing exports to resume and giving admins a way
> to recover from this state if necessary.
> 
> In the case of kexec, if the list is too large too be carried over in
> memory and an export file is configured, the list will be exported,
> preventing the measurements from being lost during kexec.
> 
> This code is based off of a previous RFC sent by Janne Karhunen[1],
> and is intended to pick up where that was left off.
> 
> In a thread with Janne Karhunen[2], it was mentioned that another
> approach, using mm had been considered. Upon some investigation the
> approach used in this RFC still seemed adequate for solving this
> problem.
> 
> [1] https://patchwork.kernel.org/project/linux-integrity/patch/201912
> 20074929.8191-1-janne.karhunen@gmail.com/
> [2] https://lore.kernel.org/linux-integrity/CAE=NcrbdS-3gVvnnEwdNSOLO
> vTenLjyppDz2aJACGRgBYSh=Gw@mail.gmail.com/
> 
> Signed-off-by: Raphael Gianotti <raphgi@linux.microsoft.com>

My original concerns of truncating the IMA measurement list have not
been addressed.  Once the IMA measurement list has been truncated,
quoting and then verifying any of the PCRs contained in the measurement
list will fail, unless the measurements have been preserved and are
readily accessible.

Amir's suggestion addresses kernel memory constraints without
truncating the IMA measurement list.

Mimi