lkml.org 
[lkml]   [2014]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v3 0/6] ima: provide signature based 'init' appraisal
From
Date
On Fri, 2014-10-10 at 17:09 +0300, Dmitry Kasatkin wrote: 
> Currently secure IMA/EVM initialization has to be done from the initramfs,
> embedded in the signed kernel image. Many systems do not want to use
> initramfs or usage of embedded initramfs makes it difficult to have
> multi-target kernels.
>
> This is a very simple patchset which makes it possible to perform secure
> initialization by requiring initial user-space to be signed.
>
> It does it by:
> - introducing a hook to load keys
> - loading IMA signed public key certificate into the '.ima' trusted keyring
> - making default IMA appraisal policy to require everything to be signed
>
> When builtin initramfs is not in use, keys cannot be read from initcalls,
> because root filesystem is not yet mounted. In order to read keys before
> executing init process, ima_prepare_keys() hook is introduced. Reading
> public keys from the kernel is justified because signature verification
> key is needed in order to verify anything else which is read from the
> file system. Public keys are X509 certificates and itself signed by the
> trusted key from the .system keyring. Kernel BIG KEYS support is an example
> of reading keys directly by the kernel.
>
> CONFIG_IMA_APPRAISE_SIGNED_INIT kernel option is provided to make the IMA
> default appraisal policy to required signature validation. Signed init
> process need to initialize EVM key and load appropriate IMA policy which
> would not require everything to be signed.
>
> Unless real '/sbin/init' is signed, a simple and practical way is to place
> all signed programs, libraries, scripts and configuration files under
> dedicated directory, for example '/ima', and run signed init process by
> providing a kernel command line parameter 'init=/ima/init'.
>
> In the first post of these patches Andrew Morton noted that
> integrity_read_file() is a very simple open-file-and-slurp-it-into-memory
> and if there are other similar functions that can be made in ./lib.
> I found out that only sound:sound_firmware.c:do_mod_firmware_load(),
> which is enabled by CONFIG_SOUND_PRIME which is related to deprecated OSS
> interface and is not enabled anymore in latest Ubuntu kernels, at least.
> So I am keeping integrity_read_file() in integrity subsystem.
>
> cpio based initramfs currently does not support extended attributes.
> There is an initial agreement to introduce light-weight tar parser to
> the kernel to support extended attributes which will make it possible to
> use IMA appraisal with external initramfs. It will benefit from this
> patchset and allow to update initramfs with signed files also on the
> running system as distros do.

Thanks, Dmitry. The patches look good, but I still will need to test.
(Once I figure out how to build a kernel without an initramfs, that
boots a distro kernel.) Only some minor suggested patch descriptions
changes ...

Mimi

> Changes in v3:
> * ima_prepare_keys() renamed to integrity_load_keys() to be the hook
> for both modules of integrity subsystem IMA/EVM.
> * removed unnecessary configuration options and declared init functions
> with '__init'.
> * updated to lately introduced 'ima_policy_flag' variable to disabled and
> enable IMA appraisal.
> * separated key loading patch from policy change patch
> * added patch which refactor vfs_read(). Agreed with Mimi to offer to
> move calling file operations hooks to a separate helper function which
> is then used by vfs_read() and integrity_kernel_read(). Applying this
> patch does not affect functionality and can be applied if agreed so.
>
> Changes in v2:
> * ima_kernel_read() moved as integrity_kernel_read() from ima_crypto.c to
> iint.c for use by integrity_read_file. The reason for keeping internal
> version is because 'integrity' version does not call fsnotify_access(),
> add_rchar() and inc_syscr().
> * integrity_read_file() moved from digsig.c to iint.c because it is used
> by IMA crypto subsystem and should not depend on digsig support being
> enabled.
>
> -Dmitry
>
> Dmitry Kasatkin (6):
> integrity: provide integrity_read_file()
> integrity: provide x509 certificate loading from the kernel
> ima: load x509 certificate from the kernel
> integrity: provide hook to load keys when rootfs is ready
> ima: require signature based appraisal
> VFS: refactor vfs_read()
>
> fs/read_write.c | 24 ++++++++---
> include/linux/fs.h | 1 +
> include/linux/integrity.h | 6 +++
> init/main.c | 6 ++-
> security/integrity/digsig.c | 37 +++++++++++++++-
> security/integrity/iint.c | 85 +++++++++++++++++++++++++++++++++++++
> security/integrity/ima/Kconfig | 22 ++++++++++
> security/integrity/ima/ima_crypto.c | 35 ++-------------
> security/integrity/ima/ima_init.c | 17 ++++++++
> security/integrity/ima/ima_policy.c | 5 +++
> security/integrity/integrity.h | 14 ++++++
> 11 files changed, 212 insertions(+), 40 deletions(-)
>




\
 
 \ /
  Last update: 2014-10-13 20:01    [W:0.127 / U:0.232 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site