From: Mimi Zohar <zohar@linux.ibm.com>
To: Roberto Sassu <roberto.sassu@huawei.com>,
"mjg59@google.com" <mjg59@google.com>
Cc: "linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Silviu Vlasceanu <Silviu.Vlasceanu@huawei.com>
Subject: Re: [PATCH v3 06/11] evm: Ignore INTEGRITY_NOLABEL if no HMAC key is loaded
Date: Fri, 04 Dec 2020 08:04:57 -0500 [thread overview]
Message-ID: <0eec775cf5c44f646defe33aec5f241a06844d3a.camel@linux.ibm.com> (raw)
In-Reply-To: <3c628dc54804469597a72d03c33e8315@huawei.com>
On Fri, 2020-12-04 at 08:05 +0000, Roberto Sassu wrote:
> > From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> > Sent: Thursday, December 3, 2020 9:43 PM
> > Hi Roberto,
> >
> > On Wed, 2020-11-11 at 10:22 +0100, Roberto Sassu wrote:
> > > When a file is being created, LSMs can set the initial label with the
> > > inode_init_security hook. If no HMAC key is loaded, the new file will have
> > > LSM xattrs but not the HMAC.
> > >
> > > Unfortunately, EVM will deny any further metadata operation on new
> > files,
> > > as evm_protect_xattr() will always return the INTEGRITY_NOLABEL error.
> > This
> > > would limit the usability of EVM when only a public key is loaded, as
> > > commands such as cp or tar with the option to preserve xattrs won't work.
> > >
> > > Ignoring this error won't be an issue if no HMAC key is loaded, as the
> > > inode is locked until the post hook, and EVM won't calculate the HMAC on
> > > metadata that wasn't previously verified. Thus this patch checks if an
> > > HMAC key is loaded and if not, ignores INTEGRITY_NOLABEL.
> >
> > I'm not sure what problem this patch is trying to solve.
> > evm_protect_xattr() is only called by evm_inode_setxattr() and
> > evm_inode_removexattr(), which first checks whether
> > EVM_ALLOW_METADATA_WRITES is enabled.
>
> The idea is to also support EVM verification when only a public key
> is loaded. An advantage to do that is that for example we can prevent
> accidental metadata changes when the signature is portable.
Right, there are a couple of scenarios. Let's be more specific as to
which scenario this patch is addressing.
- a public key is loaded and EVM_ALLOW_METADATA_WRITES is enabled,
- a public key is loaded and EVM_ALLOW_METADATA_WRITES is disabled,
- an HMAC key is loaded
For the first and last case, this patch shouldn't be necessary. Only
the second case, with EVM_ALLOW_METADATA_WRITES disabled, probably does
not work. I would claim that is working as designed.
thanks,
Mimi
next prev parent reply other threads:[~2020-12-04 13:05 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-11 9:22 [PATCH v3 00/11] evm: Improve usability of portable signatures Roberto Sassu
2020-11-11 9:22 ` [PATCH v3 01/11] evm: Execute evm_inode_init_security() only when an HMAC key is loaded Roberto Sassu
2020-12-02 17:03 ` Mimi Zohar
2020-11-11 9:22 ` [PATCH v3 02/11] evm: Load EVM key in ima_load_x509() to avoid appraisal Roberto Sassu
2020-12-02 17:27 ` Mimi Zohar
2021-03-01 18:06 ` Mimi Zohar
2020-11-11 9:22 ` [PATCH v3 03/11] evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded Roberto Sassu
2020-12-02 21:07 ` Mimi Zohar
2020-11-11 9:22 ` [PATCH v3 04/11] ima: Move ima_reset_appraise_flags() call to post hooks Roberto Sassu
2020-12-02 11:56 ` Roberto Sassu
2020-12-03 20:43 ` Mimi Zohar
2020-11-11 9:22 ` [PATCH v3 05/11] evm: Introduce evm_status_revalidate() Roberto Sassu
2020-11-11 9:22 ` [PATCH v3 06/11] evm: Ignore INTEGRITY_NOLABEL if no HMAC key is loaded Roberto Sassu
2020-12-03 20:42 ` Mimi Zohar
2020-12-04 8:05 ` Roberto Sassu
2020-12-04 13:04 ` Mimi Zohar [this message]
2020-12-04 14:59 ` Roberto Sassu
2020-11-11 9:22 ` [PATCH v3 07/11] evm: Allow xattr/attr operations for portable signatures Roberto Sassu
2020-11-11 9:22 ` [PATCH v3 08/11] evm: Allow setxattr() and setattr() for unmodified metadata Roberto Sassu
2020-11-18 17:58 ` kernel test robot
2020-11-11 9:23 ` [PATCH v3 09/11] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2020-11-11 9:23 ` [PATCH v3 10/11] ima: Introduce template field evmsig and write to field sig as fallback Roberto Sassu
2020-11-11 9:23 ` [PATCH v3 11/11] ima: Don't remove security.ima if file must not be appraised Roberto Sassu
2020-12-01 20:52 ` [PATCH v3 00/11] evm: Improve usability of portable signatures Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0eec775cf5c44f646defe33aec5f241a06844d3a.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=Silviu.Vlasceanu@huawei.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@google.com \
--cc=roberto.sassu@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).