linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Roberto Sassu <roberto.sassu@huawei.com>, mjg59@google.com
Cc: linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	silviu.vlasceanu@huawei.com
Subject: Re: [PATCH v3 00/11] evm: Improve usability of portable signatures
Date: Tue, 01 Dec 2020 15:52:45 -0500	[thread overview]
Message-ID: <feb537b46b78054239397396ea1fdabc1a3c44e2.camel@linux.ibm.com> (raw)
In-Reply-To: <20201111092302.1589-1-roberto.sassu@huawei.com>

Hi Roberto,

On Wed, 2020-11-11 at 10:22 +0100, Roberto Sassu wrote:
> EVM portable signatures are particularly suitable for the protection of
> metadata of immutable files where metadata is signed by a software vendor.
> They can be used for example in conjunction with an IMA policy that
> appraises only executed and memory mapped files.

The existing "appraise_tcb" builtin policy verify all root owned files.
Defining a new builtin policy to verify only executed and memory
mmapped files would make a nice addition and would probably simplify
testing.

> 
> However, some usability issues are still unsolved, especially when EVM is
> used without loading an HMAC key. This patch set attempts to fix the open
> issues.

We need regression tests for each of these changes.

To prevent affecting the running system, the appraise policy rules
could be limited to a loopback mounted filesystem. 

> 
> Patch 1 allows EVM to be used without loading an HMAC key. Patch 2 avoids
> appraisal verification of public keys (they are already verified by the key
> subsystem).

Loading the EVM key(s) occurs early, either the builtin x509 EVM key or
during the initramfs, makes testing difficult.  Based on
security/evm/evm, different tests could be defined for when only x509
keys, only HMAC key, or both EVM key types are loaded.

> 
> Patches 3-5 allow metadata verification to be turned off when no HMAC key
> is loaded and to use this mode in a safe way (by ensuring that IMA
> revalidates metadata when there is a change).
> 
> Patches 6-8 make portable signatures more usable if metadata verification
> is not turned off, by ignoring the INTEGRITY_NOLABEL error when no HMAC key
> is loaded, by accepting any metadata modification until signature
> verification succeeds (useful when xattrs/attrs are copied sequentially
> from a source) and by allowing operations that don't change metadata.
> 
> Patch 9 makes it possible to use portable signatures when the IMA policy
> requires file signatures and patch 10 shows portable signatures in the
> measurement list when the ima-sig template is selected.

ima-evm-utils needs to be updated to support EVM portable & immutable
signatures.

> 
> Lastly, patch 11 avoids undesired removal of security.ima when a file is
> not selected by the IMA policy.

thanks,

Mimi


      parent reply	other threads:[~2020-12-01 20:53 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-11  9:22 [PATCH v3 00/11] evm: Improve usability of portable signatures Roberto Sassu
2020-11-11  9:22 ` [PATCH v3 01/11] evm: Execute evm_inode_init_security() only when an HMAC key is loaded Roberto Sassu
2020-12-02 17:03   ` Mimi Zohar
2020-11-11  9:22 ` [PATCH v3 02/11] evm: Load EVM key in ima_load_x509() to avoid appraisal Roberto Sassu
2020-12-02 17:27   ` Mimi Zohar
2021-03-01 18:06   ` Mimi Zohar
2020-11-11  9:22 ` [PATCH v3 03/11] evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded Roberto Sassu
2020-12-02 21:07   ` Mimi Zohar
2020-11-11  9:22 ` [PATCH v3 04/11] ima: Move ima_reset_appraise_flags() call to post hooks Roberto Sassu
2020-12-02 11:56   ` Roberto Sassu
2020-12-03 20:43     ` Mimi Zohar
2020-11-11  9:22 ` [PATCH v3 05/11] evm: Introduce evm_status_revalidate() Roberto Sassu
2020-11-11  9:22 ` [PATCH v3 06/11] evm: Ignore INTEGRITY_NOLABEL if no HMAC key is loaded Roberto Sassu
2020-12-03 20:42   ` Mimi Zohar
2020-12-04  8:05     ` Roberto Sassu
2020-12-04 13:04       ` Mimi Zohar
2020-12-04 14:59         ` Roberto Sassu
2020-11-11  9:22 ` [PATCH v3 07/11] evm: Allow xattr/attr operations for portable signatures Roberto Sassu
2020-11-11  9:22 ` [PATCH v3 08/11] evm: Allow setxattr() and setattr() for unmodified metadata Roberto Sassu
2020-11-18 17:58   ` kernel test robot
2020-11-11  9:23 ` [PATCH v3 09/11] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2020-11-11  9:23 ` [PATCH v3 10/11] ima: Introduce template field evmsig and write to field sig as fallback Roberto Sassu
2020-11-11  9:23 ` [PATCH v3 11/11] ima: Don't remove security.ima if file must not be appraised Roberto Sassu
2020-12-01 20:52 ` Mimi Zohar [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=feb537b46b78054239397396ea1fdabc1a3c44e2.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mjg59@google.com \
    --cc=roberto.sassu@huawei.com \
    --cc=silviu.vlasceanu@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).