Re: [RFC][PATCH] ima: add measurement for first unverified write on ima policy file

[Mimi Zohar <zohar@linux.ibm.com>]

On Tue, 2025-02-25 at 14:12 +0100, Enrico Bravi wrote:
> The first write on the ima policy file permits to override the default
> policy defined with the ima_policy= boot parameter. This can be done
> by adding the /etc/ima/ima-policy which allows loading the custom policy
> during boot. It is also possible to load custom policy at runtime through
> file operations:
> 
> cp custom_ima_policy /sys/kernel/security/ima/policy
> cat custom_ima_policy > /sys/kernel/security/ima/policy
> 
> or by writing the absolute path of the file containing the custom policy:
> 
> echo /path/of/custom_ima_policy > /sys/kernel/security/ima/policy
> 
> In these cases, file signature can be necessary to load the policy
> (func=POLICY_CHECK). Custom policy can also be set at runtime by directly
> writing the policy stream on the ima policy file:
> 
> echo -e "measure func=BPRM_CHECK mask=MAY_EXEC\n" \
>  	"audit func=BPRM_CHECK mask=MAY_EXEC\n" \
>      > /sys/kernel/security/ima/policy
> 
> In this case, there is no mechanism to verify the integrity of the new
> policy.
> 
> Add a new entry in the ima measurements list containing the ascii custom
> ima policy buffer when not verified at load time.
> 
> Signed-off-by: Enrico Bravi <enrico.bravi@polito.it>

Hi Enrico,

This patch set hard codes measuring the initial custom IMA policy rules that
replace the builtin policies specified on the boot command line.  IMA shouldn't
hard code policy.  I'm not quite sure why you're differentiating between
measuring the initial and subsequent custom IMA policy rules.  Consider defining
a new critical-data record to measure the current IMA policy rules.  Also
consider including the new critical-data rule in the arch specific policy rules.

thanks,

Mimi