Re: [RFC] [Patch 1/1] IBAC Patch

[Serge E. Hallyn]

Quoting Mimi Zohar (zohar@xxxxxxxxxxxxxxxxxx):
> On Thu, 2007-03-08 at 22:19 -0500, Valdis.Kletnieks@xxxxxx wrote:
> > On Thu, 08 Mar 2007 17:58:16 EST, Mimi Zohar said:
> > > This is a request for comments for a new Integrity Based Access
> > > Control(IBAC) LSM module which bases access control decisions
> > > on the new integrity framework services. 
> > > 
> > > (Hopefully this will help clarify the interaction between an LSM 
> > > module and LIM module.)
> > 
> > OK, between this and the additional LIM hooks I didn't notice in an earlier
> > patch, we're starting to see the API.   The only problem is that although
> > it may be the right API for *your* code, I suspect it's a non-starter without
> > a discussion about whether it's the right *generic* API for an LIM (which will
> > require at least one dramatic bun fight about what "Integrity" means).
> 
> Absolutely, we need to make sure that the set of LIM hooks is complete and that
> nothing is missing in order to implement different types of LIM providers.  I'm 
> copying the digsig mailing list for their input on requirements, which this API 
> might not satisfy or perhaps address.

(Could you resend the IBAC patch to the disec list as well?)

Is IBAC basically a 'demo' lsm?  It only hooks bprm_security, so you
can't execute anything with a bad hash, right?  So really if you were to
also hook mmap, this would completely do away with the need for digsig?
IBAC is automatically able to use any integrity measurement modules you
write, whether they use gpg like digsig does right now, or use the tpm?

It also shows how simple it would be to hook selinux, though I guess
there are several ways we might want to hook selinux - 1. to check only
security.selinux xattrs, 2. to check integrity of entry point types, 3.
to check integrity of any files labeled by the integrity measurement
module as needing to be checked.

Is there any way for the LSM itself to direct which data and metadata
will be measured?  It looks like this is done by separately configuring
the integrity measurement module - which seems fine to me.

-serge
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/