Re: [PATCH v3 2/2] ima: add enforce-evm and log-evm modes to strictly check EVM status

From: Roberto Sassu
Date: Fri Jun 07 2019 - 10:44:52 EST

On 6/7/2019 4:24 PM, Mimi Zohar wrote:
Hi Roberto,

Thank you for updating the patch description.

Hi Mimi

no problem.

On Thu, 2019-06-06 at 13:26 +0200, Roberto Sassu wrote:
IMA and EVM have been designed as two independent subsystems: the first for
checking the integrity of file data; the second for checking file metadata.
Making them independent allows users to adopt them incrementally.

The point of intersection is in IMA-Appraisal, which calls
evm_verifyxattr() to ensure that security.ima wasn't modified during an
offline attack. The design choice, to ensure incremental adoption, was to
continue appraisal verification if evm_verifyxattr() returns
INTEGRITY_UNKNOWN. This value is returned when EVM is not enabled in the
kernel configuration, or if the HMAC key has not been loaded yet.

Although this choice appears legitimate, it might not be suitable for
hardened systems, where the administrator expects that access is denied if
there is any error. An attacker could intentionally delete the EVM keys
from the system and set the file digest in security.ima to the actual file
digest so that the final appraisal status is INTEGRITY_PASS.

Assuming that the EVM HMAC key is stored in the initramfs, not on some
other file system, and the initramfs is signed, INTEGRITY_UNKNOWN
would be limited to the rootfs filesystem.

There is another issue. The HMAC key, like the public keys, should be
loaded when appraisal is disabled. This means that we have to create a
trusted key at early boot and defer the unsealing.


Managing Director: Bo PENG, Jian LI, Yanli SHI