From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753446AbdKGRyD (ORCPT ); Tue, 7 Nov 2017 12:54:03 -0500 Received: from lhrrgout.huawei.com ([194.213.3.17]:39810 "EHLO lhrrgout.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751109AbdKGRyB (ORCPT ); Tue, 7 Nov 2017 12:54:01 -0500 Subject: Re: [PATCH v2 00/15] ima: digest list feature To: Matthew Garrett CC: linux-integrity , , , , , References: <20171107103710.10883-1-roberto.sassu@huawei.com> From: Roberto Sassu Message-ID: <899b68a6-fefe-a6db-d624-ea83f597caf1@huawei.com> Date: Tue, 7 Nov 2017 18:53:48 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit X-Originating-IP: [10.220.96.228] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090201.5A01F337.01BD,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: d68879d33dd1b60beae8c8a6e5284e28 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/7/2017 3:49 PM, Matthew Garrett wrote: > On Tue, Nov 7, 2017 at 2:36 AM, Roberto Sassu wrote: >> Finally, digest lists address also the third issue because Linux >> distribution vendors already provide the digests of files included in each >> RPM package. The digest list is stored in the RPM header, signed by the >> vendor. > > RPM's hardly universal, and distributions are in the process of moving > away from using it for distributing non-core applications (Flatpak and > Snap are becoming increasingly popular here). I think this needs to be > a generic solution rather than having the kernel tied to a specific > package format. Support for new digest list formats can be easily added. Digest list metadata includes the digest list type, so that the appropriate parser is selected. I defined a new generic format for digest lists in Patch 7/15. I would appreciate if we can discuss this format, and if you can give me suggestions about how to improve it. I think it would not be a problem to support your use case and associate metadata to each digest. Digest lists should be parsed directly by the kernel, because processing the lists in userspace would increase the chances that a compromised tool does not upload to the kernel the expected digests. Also, digest lists must be processed before init, otherwise appraisal will deny the execution. Lastly, the mechanism of parsing files from the kernel is already used to parse the IMA policy. Roberto -- HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Bo PENG, Qiuen PENG, Shengli WANG