Re: [PATCH 1/3] ima: Add TCB policy as an example

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Petr,

On Tue, 2024-11-26 at 18:38 +0100, Petr Vorel wrote:
> Signed-off-by: Petr Vorel <pvorel@suse.cz>

Except for the "dont_measure <tmpfs>" rule, the "dont_measure" rules are for
pseudo filesystems.  Including a "dont_measure <tmpfs>" policy rule was suppose
to be limited to the initramfs, and then replaced with an IMA custom policy. I
would either re-order the rules so that the "dont_measure" rules are only before
the two "func=FILE_CHECK" rules or perhaps remove the "dont_measure <tmpfs>"
policy rule.  The kernel builtin "tcb" policy should be updated as described
below.

> ---
>  .../ima/datafiles/ima_measurements/tcb.policy | 20 +++++++++++++++++++
>  1 file changed, 20 insertions(+)
>  create mode 100644 testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
> 
> diff --git a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
> new file mode 100644
> index 0000000000..280e6af87c
> --- /dev/null
> +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
> @@ -0,0 +1,20 @@
> +dont_measure fsmagic=0x9fa0
> +dont_measure fsmagic=0x62656572
> +dont_measure fsmagic=0x64626720
> +dont_measure fsmagic=0x1021994
> +dont_measure fsmagic=0x1cd1
> +dont_measure fsmagic=0x42494e4d
> +dont_measure fsmagic=0x73636673
> +dont_measure fsmagic=0xf97cff8c
> +dont_measure fsmagic=0x43415d53
> +dont_measure fsmagic=0x27e0eb
> +dont_measure fsmagic=0x63677270
> +dont_measure fsmagic=0x6e736673
> +dont_measure fsmagic=0xde5e81e4

Limit the affect of "dont_measure" rules to just the "func=FILE_CHECK" rules, by
moving them to before the "func=FILE_CHECK" rules.

> +measure func=MMAP_CHECK mask=MAY_EXEC
> +measure func=BPRM_CHECK mask=MAY_EXEC
> +measure func=FILE_CHECK mask=^MAY_READ euid=0
> +measure func=FILE_CHECK mask=^MAY_READ uid=0

Move above two "func=FILE_CHECK" rules to the end.

> +measure func=MODULE_CHECK
> +measure func=FIRMWARE_CHECK
> +measure func=POLICY_CHECK

thanks,

Mimi