From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_2 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77CEAC2BA2B for ; Tue, 14 Apr 2020 01:11:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 58598206B6 for ; Tue, 14 Apr 2020 01:11:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728657AbgDNBLp (ORCPT ); Mon, 13 Apr 2020 21:11:45 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:54894 "EHLO mx0b-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728320AbgDNBLp (ORCPT ); Mon, 13 Apr 2020 21:11:45 -0400 Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03E13EBu138982 for ; Mon, 13 Apr 2020 21:11:44 -0400 Received: from e06smtp04.uk.ibm.com (e06smtp04.uk.ibm.com [195.75.94.100]) by mx0a-001b2d01.pphosted.com with ESMTP id 30cw6q0vrf-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Apr 2020 21:11:43 -0400 Received: from localhost by e06smtp04.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 14 Apr 2020 02:11:07 +0100 Received: from b06cxnps3075.portsmouth.uk.ibm.com (9.149.109.195) by e06smtp04.uk.ibm.com (192.168.101.134) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 14 Apr 2020 02:11:04 +0100 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 03E1BbiY59244662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Apr 2020 01:11:37 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B1584C040; Tue, 14 Apr 2020 01:11:37 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DB06F4C04A; Tue, 14 Apr 2020 01:11:35 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.203.105]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 14 Apr 2020 01:11:35 +0000 (GMT) Subject: Re: [RFC] IMA: New IMA measurements for dm-crypt and selinux From: Mimi Zohar To: "Lev R. Oshvang ." , Stephen Smalley Cc: Tushar Sugandhi , linux-integrity@vger.kernel.org, LSM List , SELinux , dm-devel@redhat.com, James Morris , chpebeni@linux.microsoft.com, nramas@linux.microsoft.com, balajib@microsoft.com, sashal@kernel.org, suredd@microsoft.com In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Date: Mon, 13 Apr 2020 21:11:19 -0400 Mime-Version: 1.0 X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 20041401-0016-0000-0000-000003040B42 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20041401-0017-0000-0000-00003367FE21 Message-Id: <1586826679.7311.174.camel@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.676 definitions=2020-04-13_11:2020-04-13,2020-04-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 malwarescore=0 bulkscore=0 phishscore=0 suspectscore=0 priorityscore=1501 clxscore=1015 impostorscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004140006 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: On Sun, 2020-04-12 at 11:15 +0300, Lev R. Oshvang . wrote: > On Sat, Apr 11, 2020 at 10:07 PM Stephen Smalley > It sees to me that LKRG (kernel run time guard) takes the role of > measuring kernel structures. Perhaps you need to consult with LKRG > guys. There definitely sounds like there is some overlap.  LKRG seems to be measuring kernel structures for enforcing local integrity.  In the context of IMA, measurements are included in the IMA measurement list and used to extend a TPM PCR so that it can be quoted. A generic method for measuring structures and including them in the IMA measurement list sounds interesting. Mimi