* Immutable metadata @ 2020-03-28 11:18 Roberto Sassu 2020-03-30 2:10 ` Mimi Zohar 0 siblings, 1 reply; 6+ messages in thread From: Roberto Sassu @ 2020-03-28 11:18 UTC (permalink / raw) To: matthewgarrett@google.com, Mimi Zohar Cc: linux-integrity@vger.kernel.org, Silviu Vlasceanu Hi Matthew, Mimi I have a question about portable signatures. Is there any particular reason why a write to a file is not denied by IMA if metadata are immutable? Thanks Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Immutable metadata 2020-03-28 11:18 Immutable metadata Roberto Sassu @ 2020-03-30 2:10 ` Mimi Zohar 2020-03-30 15:46 ` Mimi Zohar 0 siblings, 1 reply; 6+ messages in thread From: Mimi Zohar @ 2020-03-30 2:10 UTC (permalink / raw) To: Roberto Sassu, matthewgarrett@google.com Cc: linux-integrity@vger.kernel.org, Silviu Vlasceanu Hi Roberto, On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote: > Hi Matthew, Mimi > > I have a question about portable signatures. Is there any particular reason > why a write to a file is not denied by IMA if metadata are immutable? As much as possible, IMA and EVM should be independent of each other. EVM is responsible for the integrity of file metadata, so it needs to read other security xattrs, but IMA shouldn't be looking at the EVM xattr. Like any other security xattr, responsibility for maintaining the xattr is left up to the particular LSM. In this case, EVM would need to prevent the file from being opened rw. Should that be hard coded or based on an EVM policy? Mimi ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Immutable metadata 2020-03-30 2:10 ` Mimi Zohar @ 2020-03-30 15:46 ` Mimi Zohar 2020-03-30 15:56 ` Roberto Sassu 0 siblings, 1 reply; 6+ messages in thread From: Mimi Zohar @ 2020-03-30 15:46 UTC (permalink / raw) To: Roberto Sassu, matthewgarrett@google.com Cc: linux-integrity@vger.kernel.org, Silviu Vlasceanu On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote: > Hi Roberto, > > On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote: > > Hi Matthew, Mimi > > > > I have a question about portable signatures. Is there any particular reason > > why a write to a file is not denied by IMA if metadata are immutable? > > As much as possible, IMA and EVM should be independent of each other. > EVM is responsible for the integrity of file metadata, so it needs to > read other security xattrs, but IMA shouldn't be looking at the EVM > xattr. > > Like any other security xattr, responsibility for maintaining the > xattr is left up to the particular LSM. In this case, EVM would need > to prevent the file from being opened rw. Should that be hard coded > or based on an EVM policy? Thinking about this a bit more, evm_verifyxattr() is already returning INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based on it. Mimi ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Immutable metadata 2020-03-30 15:46 ` Mimi Zohar @ 2020-03-30 15:56 ` Roberto Sassu 2020-03-30 18:36 ` Mimi Zohar 0 siblings, 1 reply; 6+ messages in thread From: Roberto Sassu @ 2020-03-30 15:56 UTC (permalink / raw) To: Mimi Zohar, matthewgarrett@google.com Cc: linux-integrity@vger.kernel.org, Silviu Vlasceanu > -----Original Message----- > From: Mimi Zohar [mailto:zohar@linux.ibm.com] > Sent: Monday, March 30, 2020 5:47 PM > To: Roberto Sassu <roberto.sassu@huawei.com>; > matthewgarrett@google.com > Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu > <Silviu.Vlasceanu@huawei.com> > Subject: Re: Immutable metadata > > On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote: > > Hi Roberto, > > > > On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote: > > > Hi Matthew, Mimi > > > > > > I have a question about portable signatures. Is there any particular > reason > > > why a write to a file is not denied by IMA if metadata are immutable? > > > > As much as possible, IMA and EVM should be independent of each other. > > EVM is responsible for the integrity of file metadata, so it needs to > > read other security xattrs, but IMA shouldn't be looking at the EVM > > xattr. > > > > Like any other security xattr, responsibility for maintaining the > > xattr is left up to the particular LSM. In this case, EVM would need > > to prevent the file from being opened rw. Should that be hard coded > > or based on an EVM policy? > > Thinking about this a bit more, evm_verifyxattr() is already returning > INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based on > it. Yes, this was the idea. I would say also that files with portable signatures fulfill the appraise_type=imasig requirement. I would set the IMA_DIGSIG bit in iint->atomic_flags. Is it ok? Thanks Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Immutable metadata 2020-03-30 15:56 ` Roberto Sassu @ 2020-03-30 18:36 ` Mimi Zohar 2020-03-31 6:56 ` Roberto Sassu 0 siblings, 1 reply; 6+ messages in thread From: Mimi Zohar @ 2020-03-30 18:36 UTC (permalink / raw) To: Roberto Sassu, matthewgarrett@google.com Cc: linux-integrity@vger.kernel.org, Silviu Vlasceanu On Mon, 2020-03-30 at 15:56 +0000, Roberto Sassu wrote: > > -----Original Message----- > > From: Mimi Zohar [mailto:zohar@linux.ibm.com] > > Sent: Monday, March 30, 2020 5:47 PM > > To: Roberto Sassu <roberto.sassu@huawei.com>; > > matthewgarrett@google.com > > Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu > > <Silviu.Vlasceanu@huawei.com> > > Subject: Re: Immutable metadata > > > > On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote: > > > Hi Roberto, > > > > > > On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote: > > > > Hi Matthew, Mimi > > > > > > > > I have a question about portable signatures. Is there any particular > > reason > > > > why a write to a file is not denied by IMA if metadata are immutable? > > > > > > As much as possible, IMA and EVM should be independent of each other. > > > EVM is responsible for the integrity of file metadata, so it needs to > > > read other security xattrs, but IMA shouldn't be looking at the EVM > > > xattr. > > > > > > Like any other security xattr, responsibility for maintaining the > > > xattr is left up to the particular LSM. In this case, EVM would need > > > to prevent the file from being opened rw. Should that be hard coded > > > or based on an EVM policy? > > > > Thinking about this a bit more, evm_verifyxattr() is already returning > > INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based on > > it. > > Yes, this was the idea. > > I would say also that files with portable signatures fulfill the appraise_type=imasig > requirement. I would set the IMA_DIGSIG bit in iint->atomic_flags. Is it ok? Ok, so locking doesn't seem to be an issue here. I'm not sure about re-using the existing bit. EVM_XATTR_PORTABLE_DIGSIG is dependent on the existence of a file hash. The existing bit prevents calculating and writing the file hash as an xattr. Would this affect installing new files? Mimi ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Immutable metadata 2020-03-30 18:36 ` Mimi Zohar @ 2020-03-31 6:56 ` Roberto Sassu 0 siblings, 0 replies; 6+ messages in thread From: Roberto Sassu @ 2020-03-31 6:56 UTC (permalink / raw) To: Mimi Zohar, matthewgarrett@google.com Cc: linux-integrity@vger.kernel.org, Silviu Vlasceanu > -----Original Message----- > From: Mimi Zohar [mailto:zohar@linux.ibm.com] > Sent: Monday, March 30, 2020 8:37 PM > To: Roberto Sassu <roberto.sassu@huawei.com>; > matthewgarrett@google.com > Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu > <Silviu.Vlasceanu@huawei.com> > Subject: Re: Immutable metadata > > On Mon, 2020-03-30 at 15:56 +0000, Roberto Sassu wrote: > > > -----Original Message----- > > > From: Mimi Zohar [mailto:zohar@linux.ibm.com] > > > Sent: Monday, March 30, 2020 5:47 PM > > > To: Roberto Sassu <roberto.sassu@huawei.com>; > > > matthewgarrett@google.com > > > Cc: linux-integrity@vger.kernel.org; Silviu Vlasceanu > > > <Silviu.Vlasceanu@huawei.com> > > > Subject: Re: Immutable metadata > > > > > > On Sun, 2020-03-29 at 22:10 -0400, Mimi Zohar wrote: > > > > Hi Roberto, > > > > > > > > On Sat, 2020-03-28 at 11:18 +0000, Roberto Sassu wrote: > > > > > Hi Matthew, Mimi > > > > > > > > > > I have a question about portable signatures. Is there any particular > > > reason > > > > > why a write to a file is not denied by IMA if metadata are immutable? > > > > > > > > As much as possible, IMA and EVM should be independent of each > other. > > > > EVM is responsible for the integrity of file metadata, so it needs to > > > > read other security xattrs, but IMA shouldn't be looking at the EVM > > > > xattr. > > > > > > > > Like any other security xattr, responsibility for maintaining the > > > > xattr is left up to the particular LSM. In this case, EVM would need > > > > to prevent the file from being opened rw. Should that be hard coded > > > > or based on an EVM policy? > > > > > > Thinking about this a bit more, evm_verifyxattr() is already returning > > > INTEGRITY_PASS_IMMUTABLE. I guess IMA could make decisions based > on > > > it. > > > > Yes, this was the idea. > > > > I would say also that files with portable signatures fulfill the > appraise_type=imasig > > requirement. I would set the IMA_DIGSIG bit in iint->atomic_flags. Is it ok? > > Ok, so locking doesn't seem to be an issue here. I'm not sure about > re-using the existing bit. EVM_XATTR_PORTABLE_DIGSIG is dependent on > the existence of a file hash. The existing bit prevents calculating > and writing the file hash as an xattr. Would this affect installing > new files? Since it is a portable signature, security.ima is known in advance. IMA ability to update security.ima is not necessary in this case. security.ima will be set by user space tools. Currently, there is still the issue of adding all xattrs to a file when EVM is enforcing (it refuses to copy all xattrs, as the integrity of the partial set cannot be verified). I will address this later. Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-03-31 6:56 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2020-03-28 11:18 Immutable metadata Roberto Sassu 2020-03-30 2:10 ` Mimi Zohar 2020-03-30 15:46 ` Mimi Zohar 2020-03-30 15:56 ` Roberto Sassu 2020-03-30 18:36 ` Mimi Zohar 2020-03-31 6:56 ` Roberto Sassu
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).