Re: [PATCH v6 0/4] LSM: Measure security module data

[Lakshmi Ramasubramanian]

On 8/5/20 9:14 AM, Tyler Hicks wrote:
> On 2020-08-05 09:07:48, Lakshmi Ramasubramanian wrote:
> > On 8/5/20 8:45 AM, Tyler Hicks wrote:
> > > On 2020-08-05 08:36:40, Casey Schaufler wrote:
> > > > On 8/4/2020 6:14 PM, Lakshmi Ramasubramanian wrote:
> > > > > On 8/4/20 6:04 PM, Casey Schaufler wrote:
> > > > > > On 8/4/2020 5:43 PM, Lakshmi Ramasubramanian wrote:
> > > > > > > Critical data structures of security modules are currently not measured.
> > > > > > > Therefore an attestation service, for instance, would not be able to
> > > > > > > attest whether the security modules are always operating with the policies
> > > > > > > and configuration that the system administrator had setup. The policies
> > > > > > > and configuration for the security modules could be tampered with by
> > > > > > > malware by exploiting kernel vulnerabilities or modified through some
> > > > > > > inadvertent actions on the system. Measuring such critical data would
> > > > > > > enable an attestation service to better assess the state of the system.
> > > > > >
> > > > > > I still wonder why you're calling this an LSM change/feature when
> > > > > > all the change is in IMA and SELinux. You're not putting anything
> > > > > > into the LSM infrastructure, not are you using the LSM infrastructure
> > > > > > to achieve your ends. Sure, you *could* support other security modules
> > > > > > using this scheme, but you have a configuration dependency on
> > > > > > SELinux, so that's at best going to be messy. If you want this to
> > > > > > be an LSM "feature" you need to use the LSM hooking mechanism.
> > > > >
> > > > > > I'm not objecting to the feature. It adds value. But as you've
> > > > > > implemented it it is either an IMA extension to SELinux, or an
> > > > > > SELiux extension to IMA. Could AppArmor add hooks for this without
> > > > > > changing the IMA code? It doesn't look like it to me.
> > > > >
> > > > > The check in IMA to allow the new IMA hook func LSM_STATE and LSM_POLICY when SELinux is enabled is just because SELinux is the only security module using these hooks now.
> > > > >
> > > > > To enable AppArmor, for instance, to use the new IMA hooks to measure state and policy would just require adding the check for CONFIG_SECURITY_APPARMOR. Other than that, there are no IMA changes needed to support AppArmor or other such security modules.
> > > >
> > > > This is exactly what I'm objecting to. What if a system has both SELinux
> > > > and AppArmor compiled in? What if it has both enabled?
> > >
> > > The SELinux state and policy would be measured but the AppArmor
> > > state/policy would be silently ignored. This isn't ideal as the IMA
> > > policy author would need to read the kernel code to figure out which
> > > LSMs are going to be measured.
> >
> > Tyler - I am not sure why AppArmor state\policy would be ignored when both
> > SELinux and AppArmor are enabled. Could you please clarify?
>
> I think Casey is talking about now (when AppArmor is not supported by
> this feature) and you're talking about the future (when AppArmor may be
> supported by this feature).

Got it - thanks for clarifying.

But with the current code if SELinux is enabled on the system, but 
AppArmor is not and the IMA policy contains "measure func=LSM_STATE" 
then the policy will be rejected as "-EINVAL".
So the policy author would get a feedback even now.
Correct me if I am wrong.

 -lakshmi