Linux Integrity Measurement development
 help / color / mirror / Atom feed
From: Eric Biggers <ebiggers@kernel.org>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: linux-integrity@vger.kernel.org,
	Stefan Berger <stefanb@linux.ibm.com>,
	linux-fscrypt@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 0/8] ima: support fs-verity digests and signatures
Date: Mon, 7 Feb 2022 21:50:40 -0800	[thread overview]
Message-ID: <YgIEsLsoe/sHsjBr@sol.localdomain> (raw)
In-Reply-To: <20220208014140.483447-1-zohar@linux.ibm.com>

On Mon, Feb 07, 2022 at 08:41:32PM -0500, Mimi Zohar wrote:
> Support for including fs-verity file digests and signatures in the IMA
> measurement list as well as verifying the fs-verity file digest based
> signatures, both based on IMA policy rules, was discussed prior to
> fs-verity being upstreamed[1,2].
> 
> Support for including fs-verity file digests in the 'd-ng' template field
> is based on a new policy rule option named 'digest_type=verity'.  A new
> template field named 'd-type' as well as a new template named 'ima-ngv2'
> are defined to differentiate between the regular IMA file hashes from the
> fs-verity file digests (tree-hash based file hashes) stored in the 'd-ng'
> template field.
> 
> Support for verifying fs-verity based file signatures stored in the
> 'security.ima' xattr is similarly based on the policy rule option
> 'digest_type=verity'.
> 
> To differentiate IMA from fs-verity file signatures a new xattr_type
> named IMA_VERITY_DIGSIG is defined.  Signature version 3, which is a hash
> of the ima_file_id struct, disambiguates the signatures stored as
> 'security.ima' xattr.  fs-verity only supports the new signature format
> (version 3).  To prevent abuse of the different signature formats, policy
> rules must be limited to a specific signature version.
> 
> [1] https://events19.linuxfoundation.org/wp-content/uploads/2017/11/fs-verify_Mike-Halcrow_Eric-Biggers.pdf
> [2] Documentation/filesystems/fsverity.rst

What does this patchset apply to?  I'm no longer able to apply it.  I tried
both v5.17-rc3, and the next-integrity branch of
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git.

- Eric

  parent reply	other threads:[~2022-02-08  5:50 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-08  1:41 [PATCH v4 0/8] ima: support fs-verity digests and signatures Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 1/8] ima: rename IMA_ACTION_FLAGS to IMA_NONACTION_FLAGS Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 2/8] ima: define ima_max_digest_data struct without a flexible array variable Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 3/8] fs-verity: define a function to return the integrity protected file digest Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 4/8] ima: define a new template field 'd-type' and a new template 'ima-ngv2' Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 5/8] ima: permit fsverity's file digests in the IMA measurement list Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 6/8] ima: define signature version 3 Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 7/8] ima: support fs-verity file digest based version 3 signatures Mimi Zohar
2022-02-11  0:20   ` Mimi Zohar
2022-02-08  1:41 ` [PATCH v4 8/8] fsverity: update the documentation Mimi Zohar
2022-02-08  5:50 ` Eric Biggers [this message]
2022-02-08 14:57   ` [PATCH v4 0/8] ima: support fs-verity digests and signatures Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YgIEsLsoe/sHsjBr@sol.localdomain \
    --to=ebiggers@kernel.org \
    --cc=linux-fscrypt@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stefanb@linux.ibm.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox