Messages in this thread | | | Date | Fri, 21 Oct 2022 09:53:48 -0500 | From | "Dr. Greg" <> | Subject | Re: [PATCH 2/9] security: Move trivial IMA hooks into LSM |
| |
On Wed, Oct 19, 2022 at 11:59:40AM -0700, Kees Cook wrote:
Good morning, I hope the week is ending well for everyone.
> On Wed, Oct 19, 2022 at 10:34:48AM -0400, Mimi Zohar wrote: > > > > The only thing trivial about making IMA and EVM LSMs is moving > > them to LSM hooks. Although static files may be signed and the > > signatures distributed with the file data through the normal > > distribution mechanisms (e.g. RPM), other files cannot be signed > > remotely (e.g. configuration files). For these files, both IMA > > and EVM may be configured to maintain persistent file state stored > > as security xattrs in the form of security.ima file hashes or > > security.evm HMACs. The LSM flexibility of enabling/disabling IMA > > or EVM on a per boot basis breaks this usage, potentially > > preventing subsequent boots.
> I'm not suggesting IMA and EVM don't have specific behaviors that > need to be correctly integrated into the LSM infrastructure. In > fact, I spent a lot of time designing that infrastructure to be > flexible enough to deal with these kinds of things. (e.g. plumbing > "enablement", etc.) As I mentioned, this was more of trying to > provide a head-start on the conversion. I don't intend to drive this > -- please take whatever is useful from this example and use it. :) > I'm happy to help construct any missing infrastructure needed > (e.g. LSM_ORDER_LAST, etc).
We are 2-3 weeks out from submitting for review and inclusion in the kernel, a new LSM, and an associated userspace stack, that will have a high degree of significance with respect to these conversations.
> Kees Cook
Best wishes for a pleasant fall weekend.
As always,
Dr. Greg The Quixote Project - Flailing at the Travails of Cybersecurity
| |