From: Eric Biggers <ebiggers@kernel.org>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: linux-integrity@vger.kernel.org,
Stefan Berger <stefanb@linux.ibm.com>,
linux-fscrypt@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 0/8] ima: support fs-verity digests and signatures
Date: Mon, 7 Feb 2022 21:50:40 -0800 [thread overview]
Message-ID: <YgIEsLsoe/sHsjBr@sol.localdomain> (raw)
In-Reply-To: <20220208014140.483447-1-zohar@linux.ibm.com>
On Mon, Feb 07, 2022 at 08:41:32PM -0500, Mimi Zohar wrote:
> Support for including fs-verity file digests and signatures in the IMA
> measurement list as well as verifying the fs-verity file digest based
> signatures, both based on IMA policy rules, was discussed prior to
> fs-verity being upstreamed[1,2].
>
> Support for including fs-verity file digests in the 'd-ng' template field
> is based on a new policy rule option named 'digest_type=verity'. A new
> template field named 'd-type' as well as a new template named 'ima-ngv2'
> are defined to differentiate between the regular IMA file hashes from the
> fs-verity file digests (tree-hash based file hashes) stored in the 'd-ng'
> template field.
>
> Support for verifying fs-verity based file signatures stored in the
> 'security.ima' xattr is similarly based on the policy rule option
> 'digest_type=verity'.
>
> To differentiate IMA from fs-verity file signatures a new xattr_type
> named IMA_VERITY_DIGSIG is defined. Signature version 3, which is a hash
> of the ima_file_id struct, disambiguates the signatures stored as
> 'security.ima' xattr. fs-verity only supports the new signature format
> (version 3). To prevent abuse of the different signature formats, policy
> rules must be limited to a specific signature version.
>
> [1] https://events19.linuxfoundation.org/wp-content/uploads/2017/11/fs-verify_Mike-Halcrow_Eric-Biggers.pdf
> [2] Documentation/filesystems/fsverity.rst
What does this patchset apply to? I'm no longer able to apply it. I tried
both v5.17-rc3, and the next-integrity branch of
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git.
- Eric
next prev parent reply other threads:[~2022-02-08 5:50 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-08 1:41 [PATCH v4 0/8] ima: support fs-verity digests and signatures Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 1/8] ima: rename IMA_ACTION_FLAGS to IMA_NONACTION_FLAGS Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 2/8] ima: define ima_max_digest_data struct without a flexible array variable Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 3/8] fs-verity: define a function to return the integrity protected file digest Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 4/8] ima: define a new template field 'd-type' and a new template 'ima-ngv2' Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 5/8] ima: permit fsverity's file digests in the IMA measurement list Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 6/8] ima: define signature version 3 Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 7/8] ima: support fs-verity file digest based version 3 signatures Mimi Zohar
2022-02-11 0:20 ` Mimi Zohar
2022-02-08 1:41 ` [PATCH v4 8/8] fsverity: update the documentation Mimi Zohar
2022-02-08 5:50 ` Eric Biggers [this message]
2022-02-08 14:57 ` [PATCH v4 0/8] ima: support fs-verity digests and signatures Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YgIEsLsoe/sHsjBr@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stefanb@linux.ibm.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox