From: Mimi Zohar <zohar@linux.ibm.com>
To: Roberto Sassu <roberto.sassu@huawei.com>,
"mjg59@google.com" <mjg59@google.com>
Cc: "linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Silviu Vlasceanu <Silviu.Vlasceanu@huawei.com>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH 07/11] evm: Set IMA_CHANGE_XATTR/ATTR bit if EVM_ALLOW_METADATA_WRITES is set
Date: Tue, 01 Sep 2020 07:05:05 -0400 [thread overview]
Message-ID: <ae06c113ec91442e293f2466cae3dd1b81f241eb.camel@linux.ibm.com> (raw)
In-Reply-To: <a5e6a5acf2274a6d844b275dacfbabb8@huawei.com>
On Tue, 2020-09-01 at 09:08 +0000, Roberto Sassu wrote:
> > From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> > Sent: Monday, August 24, 2020 2:18 PM
> > On Thu, 2020-06-18 at 18:04 +0200, Roberto Sassu wrote:
> > > When EVM_ALLOW_METADATA_WRITES is set, EVM allows any operation
> > on
> > > metadata. Its main purpose is to allow users to freely set metadata when
> > > they are protected by a portable signature, until the HMAC key is loaded.
> > >
> > > However, IMA is not notified about metadata changes and, after the first
> > > appraisal, always allows access to the files without checking metadata
> > > again.
> >
> > ^after the first successful appraisal
> > >
> > > This patch checks in evm_reset_status() if EVM_ALLOW_METADATA
> > WRITES is
> > > enabled and if it is, sets the IMA_CHANGE_XATTR/ATTR bits depending on
> > the
> > > operation performed. At the next appraisal, metadata are revalidated.
> >
> > EVM modifying IMA bits crosses the boundary between EVM and IMA.
> > There
> > is already an IMA post_setattr hook. IMA could reset its own bit
> > there. If necessary EVM could export as a function it's status info.
>
> I wouldn't try to guess in IMA when EVM resets its status. We would have
> to duplicate the logic to check if an EVM key is loaded, if the passed xattr
> is a POSIX ACL, ...
Agreed, but IMA could call an EVM function.
>
> I think it is better to set a flag, maybe a new one, directly in EVM, to notify
> the integrity subsystem that iint->evm_status is no longer valid.
>
> If the EVM flag is set, IMA would reset the appraisal flags, as it uses
> iint->evm_status for appraisal. We can consider to reset also the measure
> flags when we have a template that includes file metadata.
When would IMA read the EVM flag? Who would reset the flag? At what
point would it be reset? Just as EVM shouldn't be resetting the IMA
flag, IMA shouldn't be resetting the EVM flag.
Mimi
next prev parent reply other threads:[~2020-09-01 11:52 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200618160329.1263-2-roberto.sassu@huawei.com>
2020-06-18 16:04 ` [PATCH 06/11] evm: Allow setxattr() and setattr() if metadata digest won't change Roberto Sassu
2020-08-24 12:17 ` Mimi Zohar
2020-08-31 8:51 ` Roberto Sassu
2020-06-18 16:04 ` [PATCH 07/11] evm: Set IMA_CHANGE_XATTR/ATTR bit if EVM_ALLOW_METADATA_WRITES is set Roberto Sassu
2020-08-24 12:17 ` Mimi Zohar
2020-09-01 9:08 ` Roberto Sassu
2020-09-01 11:05 ` Mimi Zohar [this message]
2020-09-01 11:41 ` Roberto Sassu
2020-09-01 12:55 ` Mimi Zohar
2020-06-18 16:04 ` [PATCH 08/11] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:04 ` [PATCH 09/11] ima: Don't remove security.ima if file must not be appraised Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:04 ` [PATCH 10/11] ima: Don't ignore errors from crypto_shash_update() Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:06 ` [PATCH 11/11] ima: Remove semicolon at the end of ima_get_binary_runtime_size() Roberto Sassu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ae06c113ec91442e293f2466cae3dd1b81f241eb.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=Silviu.Vlasceanu@huawei.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@google.com \
--cc=roberto.sassu@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox