Re: [RFC] IMA: New IMA measurements for dm-crypt and selinux

[Tushar Sugandhi <tusharsu@linux.microsoft.com>]

On 2020-04-08 9:34 a.m., Casey Schaufler wrote:
> On 4/8/2020 3:19 AM, Tushar Sugandhi wrote:
<snip>
>>
>> B. Measuring selinux constructs:
>>      We propose to add an IMA hook in enforcing_set() present under
>>      security/selinux/include/security.h.
>>      enforcing_set() sets the selinux state to enforcing/permissive etc.
>>      and is called from key places like selinux_init(),
>>      sel_write_enforce() etc.
>>      The hook will measure various attributes related to selinux status.
>>      Majority of the attributes are present in the struct selinux_state
>>      present in security/selinux/include/security.h
>>      e.g.
>>      $sestatus
>>             SELinux status:              enabled
>>             SELinuxfs mount:             /sys/fs/selinux
>>             SELinux root directory:      /etc/selinux
>>             Loaded policy name:          default
>>             Current mode:                permissive
>>             Mode from config file:       permissive
>>             Policy MLS status:           enabled
>>             Policy deny_unknown status:  allowed
>>             Memory protection checking:  requested (insecure)
>>             Max kernel policy version:   32
>>
>>      The above attributes will be serialized into a set of key=value
>>      pairs when passed to IMA for measurement.
>>
>>      Proposed Function Signature of the IMA hook:
>>      void ima_selinux_status(void *selinux_status, int len);
>>
>> Please provide comments\feedback on the proposal.
> 
> TL;DR - Why make this SELinux specific?
> 
> Integrating IMA and SELinux is a layering violation at best.
> Why isn't this ima_lsm_status(void *lsm_status, int len)?
That seems like a good idea.
I will investigate where can I place the hook for LSM.
Please let me know if you have any recommendations.
> Or, better yet, how about ima_lsm_status(char *name, void *value, int len),
> and you pass each name/value pair separately? That makes the
> interface generally useful.
> 
> Believe it or not, there *ARE* security modules that
> are not SELinux.
> 
>>
>> Thanks,
>> Tushar
>>
>> [1] https://sourceforge.net/p/linux-ima/wiki/Home/
>> [2] https://selinuxproject.org/page/FAQ
>> [3] https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt