From: Mimi Zohar <zohar@linux.ibm.com>
To: Casey Schaufler <casey@schaufler-ca.com>,
Roberto Sassu <roberto.sassu@huawei.com>,
mjg59@google.com
Cc: linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 04/11] ima: Move ima_reset_appraise_flags() call to post hooks
Date: Mon, 26 Apr 2021 15:49:00 -0400 [thread overview]
Message-ID: <93858a47a29831ca782c8388faaa43c8ffc3f5cd.camel@linux.ibm.com> (raw)
In-Reply-To: <c3bb1069-c732-d3cf-0dde-7a83b3f31871@schaufler-ca.com>
On Fri, 2021-03-05 at 09:30 -0800, Casey Schaufler wrote:
> On 3/5/2021 7:19 AM, Roberto Sassu wrote:
> > ima_inode_setxattr() and ima_inode_removexattr() hooks are called before an
> > operation is performed. Thus, ima_reset_appraise_flags() should not be
> > called there, as flags might be unnecessarily reset if the operation is
> > denied.
> >
> > This patch introduces the post hooks ima_inode_post_setxattr() and
> > ima_inode_post_removexattr(), and adds the call to
> > ima_reset_appraise_flags() in the new functions.
>
> I don't see anything wrong with this patch in light of the way
> IMA and EVM have been treated to date.
>
> However ...
>
> The special casing of IMA and EVM in security.c is getting out of
> hand, and appears to be unnecessary. By my count there are 9 IMA
> hooks and 5 EVM hooks that have been hard coded. Adding this IMA
> hook makes 10. It would be really easy to register IMA and EVM as
> security modules. That would remove the dependency they currently
> have on security sub-system approval for changes like this one.
> I know there has been resistance to "IMA as an LSM" in the past,
> but it's pretty hard to see how it wouldn't be a win.
Somehow I missed the new "lsm=" boot command line option, which
dynamically allows enabling/disabling LSMs, being upstreamed. This
would be one of the reasons for not making IMA/EVM full LSMs.
Both IMA and EVM file data/metadata is persistent across boots. If
either one or the other is not enabled the file data hash or file
metadata HMAC will not properly be updated, potentially preventing the
system from booting when re-enabled. Re-enabling IMA and EVM would
require "fixing" the mutable file data hash and HMAC, without any
knowledge of what the "fixed" values should be. Dave Safford referred
to this as "blessing" the newly calculated values.
Mimi
next prev parent reply other threads:[~2021-04-26 19:49 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-05 15:19 [PATCH v4 00/11] evm: Improve usability of portable signatures Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 01/11] evm: Execute evm_inode_init_security() only when an HMAC key is loaded Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 02/11] evm: Load EVM key in ima_load_x509() to avoid appraisal Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 03/11] evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 04/11] ima: Move ima_reset_appraise_flags() call to post hooks Roberto Sassu
2021-03-05 17:30 ` Casey Schaufler
2021-04-26 19:49 ` Mimi Zohar [this message]
2021-04-27 9:25 ` Roberto Sassu
2021-04-27 15:34 ` Mimi Zohar
2021-04-27 15:57 ` Roberto Sassu
2021-04-27 16:03 ` Mimi Zohar
2021-04-27 16:39 ` Casey Schaufler
2021-04-27 16:48 ` Mimi Zohar
2021-04-28 7:48 ` Roberto Sassu
2021-04-28 15:35 ` Roberto Sassu
2021-04-30 18:00 ` Mimi Zohar
2021-05-03 7:41 ` Roberto Sassu
2021-05-03 13:21 ` Mimi Zohar
2021-03-05 15:19 ` [PATCH v4 05/11] evm: Introduce evm_status_revalidate() Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 06/11] evm: Ignore INTEGRITY_NOLABEL/INTEGRITY_NOXATTRS if conditions are safe Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 07/11] evm: Allow xattr/attr operations for portable signatures Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 08/11] evm: Allow setxattr() and setattr() for unmodified metadata Roberto Sassu
2021-03-25 10:53 ` Roberto Sassu
2021-03-25 12:13 ` Christian Brauner
2021-03-25 12:21 ` Christian Brauner
2021-03-25 12:40 ` Roberto Sassu
2021-03-25 12:39 ` Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 09/11] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 10/11] ima: Introduce template field evmsig and write to field sig as fallback Roberto Sassu
2021-03-05 15:19 ` [PATCH v4 11/11] ima: Don't remove security.ima if file must not be appraised Roberto Sassu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=93858a47a29831ca782c8388faaa43c8ffc3f5cd.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=casey@schaufler-ca.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@google.com \
--cc=roberto.sassu@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).