Re: [PATCH v4 00/14] ima: introduce IMA Digest Lists extension

[Roberto Sassu]

On 6/17/2019 8:56 AM, Roberto Sassu wrote:
> On 6/14/2019 7:54 PM, Roberto Sassu wrote:
> > This patch set introduces a new IMA extension called IMA Digest Lists.
> >
> > At early boot, the extension preloads in kernel memory reference digest
> > values, that can be compared with actual file digests when files are
> > accessed in the system.
> >
> > The extension will open for new possibilities: PCR with predictable 
> > value,
> > that can be used for sealing policies associated to data or TPM keys;
> > appraisal based on reference digests already provided by Linux 
> > distribution
> > vendors in the software packages.
> >
> > The first objective can be achieved because the PCR values does not 
> > depend
> > on which and when files are measured: the extension measures digest lists
> > sequentially and files whose digest is not in the digest list.
> >
> > The second objective can be reached because the extension is able to
> > extract reference measurements from packages (with a user space tool) and
> > use it as a source for appraisal verification as the reference came from
> > the security.ima xattr. This approach will also reduce the overhead as 
> > only
> > one signature is verified for many files (as opposed to one signature for
> > each file with the current implementation).
> >
> > This version of the patch set provides a clear separation between current
> > and new functionality. First, the new functionality must be explicitly
> > enabled from the kernel command line. Second, results of operations
> > performed by the extension can be distinguished from those obtained from
> > the existing code: measurement entries created by the extension have a
> > different PCR; mutable files appraised with the extension have a 
> > different
> > security.ima type.
> >
> > The review of this patch set should start from patch 11 and 12, which
> > modify the IMA-Measure and IMA-Appraise submodules to use digest lists.
> > Patch 1 to 5 are prerequisites. Patch 6 to 10 adds support for digest
> > lists. Finally, patch 13 introduces two new policies to measure/appraise
> > rootfs and patch 14 adds the documentation (including a flow chart to
> > show how IMA has been modified).
> >
> > The user space tools to configure digest lists are available at:
> >
> > https://github.com/euleros/digest-list-tools/releases/tag/v0.3
> >
> > The patch set applies on top of linux-integrity/next-queued-testing
> > (73589972b987).
> >
> > It is necessary to apply also:
> > https://patchwork.kernel.org/cover/10957495/
>
> Another dependency is:
>
> https://patchwork.kernel.org/cover/10979341/
>
> Roberto
I uploaded this patch set and all the required dependencies to:

https://github.com/euleros/linux/releases/tag/ima-digest-lists-v4

It should be easy to test. Let me know if you have questions about the
installation.


Mimi, do you have any thoughts on this version?

Thanks

Roberto

--
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI