From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2D6AC4741F for ; Fri, 6 Nov 2020 15:51:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9ACAC22202 for ; Fri, 6 Nov 2020 15:51:05 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mjrrY/Tr" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727502AbgKFPvF (ORCPT ); Fri, 6 Nov 2020 10:51:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726422AbgKFPvF (ORCPT ); Fri, 6 Nov 2020 10:51:05 -0500 Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 69EE6C0613CF; Fri, 6 Nov 2020 07:51:03 -0800 (PST) Received: by mail-qk1-x72b.google.com with SMTP id k9so1444308qki.6; Fri, 06 Nov 2020 07:51:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=bq7XuOEfuXc9Pxiu4FSTXLphcTRNZb2mSIHK6qtCQCk=; b=mjrrY/TrHBNzxRXT+iKjtSkQbp40fh8bKyd66ktkoad6y6tAByVGWnxZ+FY6No0qx3 vT6wtFQuaLecSBlLycrzJBUL7WqATxAZ7ic9YyApNlLcVdryQRdAdG+9b8lGo2Z5t88S QDiEzYoGIPvny3erZomiwAwMQjKbJezmLNEd/EW6BUwQyXJZwZl97pWiHHz8mqssanDi 97qBJEBtUeJ0fSRTbwRqomNKmf69p860hhs1sVti5dveyoWC4FWKvlOaCamOfX/taweH qghfF+eczISUp/3jUKbgLA7mgWXZ4qi1DhWmHN+5WZ+ETsH2Oe6sK32F18v19f6JbwI2 qMDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=bq7XuOEfuXc9Pxiu4FSTXLphcTRNZb2mSIHK6qtCQCk=; b=bwu4wIz81ZHps1MGAsYmMpjnmtaztQnGUdJ7eJiyTtnRzN1qrTBlgvEV2I2gXzFJcR ZgzCmp844l7GfSC3kBJwOUvKs1ey8Ha/hry8uhyzTbzRI0APbCMYYDLv/nzDPP4qQJx3 A3rXKTXJ3qqCC87KMLTjVBwND2XgWoMmGznI+zZET7gF+bP/rKNkOYWazsTx3jqTRAXf EaJ6REwamg2WlLYi7hICgTQ+9gATaQGH6/lx1sBS1SIlMbYb4u7VSmb0tiRE67Y4Aki2 7zoj2tBWbcz0CcJzZj6G0ZYFESuV64MwCqVFSb8ycHMDbvSiqtpyIepnrIYA/UYQCkM8 8xJw== X-Gm-Message-State: AOAM533d/Y6FOaOb19siHMRL0BD4M+v2Kgt7mq8B/mWfR5ivPdh0Vjvs koWlb7aJ0pB+n8ixknJPFzk/r1RF1yZR9Ezp2T9HFifPRn7PJA== X-Google-Smtp-Source: ABdhPJwvVQaAyMIixz5y+7TlHbDQDNXNbgp4yP0UaGtTJ102N6nTPA6OVmXdZ93NXzNttLn355empaQ58Upty7VQmbY= X-Received: by 2002:a37:4f0b:: with SMTP id d11mr2243897qkb.74.1604677862404; Fri, 06 Nov 2020 07:51:02 -0800 (PST) MIME-Version: 1.0 References: <28afd683-8423-0331-4b7d-ec71d46be30c@rosalinux.ru> In-Reply-To: <28afd683-8423-0331-4b7d-ec71d46be30c@rosalinux.ru> From: rishi gupta Date: Fri, 6 Nov 2020 21:20:50 +0530 Message-ID: Subject: Re: Selinux policy for x509_ima.der public certificate loaded by kernel during boot To: Mikhail Novosyolov Cc: linux-integrity , selinux-refpolicy@vger.kernel.org, selinux@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On Fri, Nov 6, 2020 at 8:42 PM Mikhail Novosyolov wrote: > > 06.11.2020 15:22, rishi gupta =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > > I am getting below error as selinux is denying access to the .ima > > keyring. Looking for guidance for asymmetric public key selinux > > policy. > > > > [ 172.014855] integrity: Request for unknown key 'id:87deb3bf' err -13 > I am getting the same error without selinux. If I make selinux permissive, it works for me. So I know in my case the problem is selinux. > > > > [ 172.015035] audit: type=3D1800 audit(1604596570.579:240): pid=3D825 > > uid=3D1021 auid=3D4294967295 ses=3D4294967295 > > subj=3Dsystem_u:system_r:mydaemon_t:s0-s15:c0.c1023 op=3D"appraise_data= " > > cause=3D"invalid-signature" comm=3D"mydaemon" > > name=3D"/usr/lib/libstdc++.so.6.0.25" dev=3D"ubifs" ino=3D14353 res=3D0 > Selinux context is just logged here. It has nothing to do with reasons of= ivalid signature. Public key seems to be not loaded. Basically when we access a file, driver checks if selinux allow access to it or not. In my case this function is returning -EACCES https://github.com/torvalds/linux/blob/master/security/keys/permission.c#L8= 8 > > > > (a) Do I need to set the selinux context of file > > /etc/keys/x509_ima.der. If yes what it should be. > > (b) Do I need to set some selinux rule for .ima keyring. If yes how. I > > tried a lot but could not find any resource. > Usually IMA policy is loaded before SELinux policy I think I am using the policy defined in ima_policy driver as of now. My kernel is = 4.14. > > > > Regards, > > Rishi