Re: [PATCH v2 2/8] ima_setup.sh: Allow to load predefined policy

[Petr Vorel <pvorel@suse.cz>]

Hi Mimi,

...
> > Do I understand correctly you talk about policy containing func=POLICY_CHECK [1]?

> Yes.  On a secure boot enabled system, the architecture specific policy might
> require the IMA policy itself to be signed.

> Snippet from ima_fs.c:

> #if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) &&
> IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY)
>         "appraise func=POLICY_CHECK appraise_type=imasig",
> #endif

> > Maybe there could be a test based on example [2].

> > echo /home/user/tmpfile > /sys/kernel/security/ima/policy
> > cp tmpfile /sys/kernel/security/ima/policy
> > cat tmpfile > /sys/kernel/security/ima/policy

> All of the above will load a policy, assuming the policy itself doesn't need to
> be signed.  Only "echo /home/user/tmpfile > /sys/kernel/security/ima/policy" can
> load a signed policy.

> Loading a CA key (mokutil), signing (evmctl)[1] and loading (keyctl) an IMA
> policy is probably beyond LTP.  The purpose of this test would be to detect
> whether policies need to be signed.

The most advanced for LTP is currently solving reboot [3].

FYI we plan to add support [4] to our kirk tool [5] (currently supports running LTP,
kselftest and liburing, testing via SSH, qemu).

I suppose given how sparse is IMA/EVM testing in LTP this can wait (there are
more basic features not covered by testing). I suppose most of the testing you
have in ima-evm-utils repo (at least I found only IMA related code in kselftest
in BPF tests).

> Going forward what's probably needed is a new package containing a set of pre-
> defined sample custom policies, which are signed by the distro.

Please let me now once you or other IMA devs are doing any work in this.

Kind regards,
Petr

> [1] Directions for signing and loading a custom policy,
> https://ima-doc.readthedocs.io/en/latest/ima-utilities.html#sign-and-install-a-custom-policy

> Thanks,

> Mimi


> > Kind regards,
> > Petr

> > [1] https://ima-doc.readthedocs.io/en/latest/policy-syntax.html#func-policy-check
> > [2] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#runtime-custom-policy

[3] https://github.com/linux-test-project/ltp/issues/868
[4] https://github.com/linux-test-project/kirk/issues/12
[5] https://github.com/linux-test-project/kirk

> > > > +}

> > > Mimi