linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: linux-security-module@vger.kernel.org
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
	linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	David Safford <safford@watson.ibm.com>,
	Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Subject: [RFC][PATCH v1 0/9] ima: appraisal extension
Date: Mon, 30 Jan 2012 17:13:55 -0500	[thread overview]
Message-ID: <1327961644-6886-1-git-send-email-zohar@linux.vnet.ibm.com> (raw)

This is the initial posting of the IMA-appraisal patch set, separate
from EVM.

IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party.  The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'.  The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.

New hooks:
ima_inode_setxattr(), ima_inode_removexattr(), ima_inode_post_setattr()

IMA-appraisal extends the measurement policy ABI with two new keywords:
appraise/dont_appraise and extends the ima_tcb policy to appraise all
files owned by root.  Like the ima_tcb measurement policy, the ima_tcb
appraisal policy does not appraise pseudo filesystem files (eg. debugfs,
tmpfs, securityfs, selinuxfs or ramfs.)

Additional rules can be added to the default IMA measurement/appraisal
policy, which take advantage of the SELinux labels, for a more fine
grained policy.

Locking changes:

The ima-appraisal extension maintains the file integrity measurement as
an extended attribute 'security.ima'.  ima_file_free(), called on __fput(),
updates 'security.ima' to reflect any changes made to the file.  In fix
mode, process_measurement() writes 'security.ima' to reflect the current
file hash.  Writing extended attributes and other file metadata (eg. chmod),
requires taking the i_mutex.  Both ima_file_free() and process_measurement()
took the iint->mutex and then the i_mutex, while chmod() took the locks in
reverse order.  To resolve the potential lock inversion deadlock, the
redundant iint->mutex was eliminated.

Prereqs:
   vfs: fix IMA lockdep circular locking dependency
   vfs: Correctly set the dir i_mutex lockdep class
   vfs: iversion truncate bug fix

Mimi

Dmitry Kasatkin (2):
  ima: allocating iint improvements
  ima: digital signature verification support

Mimi Zohar (7):
  vfs: extend vfs_removexattr locking
  vfs: move ima_file_free before releasing the file
  ima: integrity appraisal extension
  ima: add appraise action keywords and default rules
  ima: add inode_post_setattr call
  ima: add ima_inode_setxattr/removexattr function and calls
  ima: add support for different security.ima data types

 Documentation/ABI/testing/ima_policy  |   25 +++-
 Documentation/kernel-parameters.txt   |    4 +
 fs/attr.c                             |    2 +
 fs/file_table.c                       |    2 +-
 fs/xattr.c                            |    6 +-
 include/linux/ima.h                   |   27 ++++
 include/linux/integrity.h             |    7 +-
 include/linux/xattr.h                 |    3 +
 security/integrity/evm/evm_main.c     |    3 +
 security/integrity/iint.c             |   64 ++++-----
 security/integrity/ima/Kconfig        |   15 ++
 security/integrity/ima/Makefile       |    2 +
 security/integrity/ima/ima.h          |   39 +++++-
 security/integrity/ima/ima_api.c      |   55 +++++--
 security/integrity/ima/ima_appraise.c |  261 +++++++++++++++++++++++++++++++++
 security/integrity/ima/ima_crypto.c   |    9 +-
 security/integrity/ima/ima_main.c     |   89 +++++++----
 security/integrity/ima/ima_policy.c   |   88 ++++++++++--
 security/integrity/integrity.h        |   11 +-
 security/security.c                   |    6 +
 20 files changed, 605 insertions(+), 113 deletions(-)
 create mode 100644 security/integrity/ima/ima_appraise.c

-- 
1.7.6.5


             reply	other threads:[~2012-01-30 22:17 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-01-30 22:13 Mimi Zohar [this message]
2012-01-30 22:13 ` [RFC][PATCH v1 1/9] vfs: extend vfs_removexattr locking Mimi Zohar
2012-01-30 22:13 ` [RFC][PATCH v1 2/9] vfs: move ima_file_free before releasing the file Mimi Zohar
2012-01-30 22:13 ` [RFC][PATCH v1 3/9] ima: integrity appraisal extension Mimi Zohar
2012-01-30 22:13 ` [RFC][PATCH v1 4/9] ima: add appraise action keywords and default rules Mimi Zohar
2012-01-30 22:14 ` [RFC][PATCH v1 5/9] ima: allocating iint improvements Mimi Zohar
2012-02-01 16:58   ` Eric Paris
2012-02-01 18:46     ` Kasatkin, Dmitry
2012-02-09  9:40       ` Kasatkin, Dmitry
2012-01-30 22:14 ` [RFC][PATCH v1 6/9] ima: add inode_post_setattr call Mimi Zohar
2012-01-30 22:14 ` [RFC][PATCH v1 7/9] ima: add ima_inode_setxattr/removexattr function and calls Mimi Zohar
2012-01-30 22:14 ` [RFC][PATCH v1 8/9] ima: add support for different security.ima data types Mimi Zohar
2012-01-30 22:14 ` [RFC][PATCH v1 9/9] ima: digital signature verification support Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1327961644-6886-1-git-send-email-zohar@linux.vnet.ibm.com \
    --to=zohar@linux.vnet.ibm.com \
    --cc=dmitry.kasatkin@intel.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=safford@watson.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).