Re: [PATCH V2 3/4] IMA: Optionally make use of filesystem-provided hashes

[Roberto Sassu <roberto.sassu@huawei.com>]

On 5/3/2019 1:02 AM, Mimi Zohar wrote:
> On Thu, 2019-05-02 at 15:37 -0700, Matthew Garrett wrote:
>> On Thu, May 2, 2019 at 1:25 PM Mimi Zohar <zohar@linux.ibm.com> wrote:
>>> Suppose instead of re-using the "d-ng" for the vfs hash, you defined a
>>> new field named d-vfs.  Instead of the "ima-ng" or "d-ng|n-ng", the
>>> template name could be "d-vfs|n-ng".
>>
>> Is it legitimate to redefine d-ng such that if the hash comes from the
>> filesystem it adds an additional prefix? This will only occur if the
>> admin has explicitly enabled the trusted_vfs option, so we wouldn't
>> break any existing configurations. Otherwise, I'll look for the
>> cleanest approach for making this dynamic.
> 
> I would assume modifying d-ng would break existing attestation
> servers.

Yes, I would also prefer to avoid modification of d-ng.


> Perhaps instead of making the template format dynamic based on fields,
> as I suggested above, define a per policy rule template format option.

This should not be too complicated. The template to use will be returned
by ima_get_action() to process_measurement().

Roberto

-- 
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI