Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3]

From: David Howells
Date: Thu Mar 31 2016 - 11:18:15 EST

Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:

> > The third option I've added is that you can't add to .ima at all. You only
> > get what's included at build time. You don't want that option?
> Adding keys directly to the IMA keyring is a new feature. There's enough
> changes as it is, that this patch should be limited to replicating existing
> usage, not adding new features.

The three choice options I implemented don't exactly provide new features.

config IMA_LOAD_X509

allow keys to be loaded in at compile time, secondly,


allows keys to be inserted whilst the kernel is running if those keys are
"trusted", and, thirdly,


modifies what it means for a key to be "trusted" by allowing intermediate
levels of CA certificates to be chained.

So, of the three choice options I'm providing,


is equivalent to setting INTEGRITY_SIGNATURE plus IMA_LOAD_X509 if you set it;


is the equivalent of turning on IMA_MOK_KEYRING as well.

Fair enough, you can argue that:


allowing you to disable addition of keys whilst the kernel is running is a
'new feature'. I disagree, I think it should be there for completeness.

> > > > + bool "No runtime key addition"
> > > ...
> > > This could be useful for namespacing IMA.
> >
> > You said you didn't want this option above (to quote: In this patch, the
> > choice should be between checking just the builtin trusted keys or both the
> > builtin trusted and secondary keys.)
> Does the ability of adding builtin X.509 certificates directly to the
> IMA keyring already exist or is it something that still needs to be
> done? Assuming the latter, this option would be added with the ability
> of adding X.509 certificates directly to the IMA keyring.

I don't know what you mean by "directly" here. Even without this patch, you
can already add X.509 certs to the .ima keyring, both at compile time and at
runtime. This patch doesn't take that away - except by explicitly setting the
option to prevent runtime addition.