From: Mimi Zohar <zohar@linux.ibm.com>
To: Tushar Sugandhi <tusharsu@linux.microsoft.com>,
stephen.smalley.work@gmail.com, casey@schaufler-ca.com,
agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com,
paul@paul-moore.com
Cc: tyhicks@linux.microsoft.com, sashal@kernel.org,
jmorris@namei.org, nramas@linux.microsoft.com,
linux-integrity@vger.kernel.org, selinux@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, dm-devel@redhat.com
Subject: Re: [PATCH v5 4/7] IMA: add policy to measure critical data
Date: Fri, 06 Nov 2020 08:43:01 -0500 [thread overview]
Message-ID: <6d835878af2f11c837633510775742e57a1506eb.camel@linux.ibm.com> (raw)
In-Reply-To: <20201101222626.6111-5-tusharsu@linux.microsoft.com>
Hi Tushar,
On Sun, 2020-11-01 at 14:26 -0800, Tushar Sugandhi wrote:
> System administrators should be able to choose which kernel subsystems
> they want to measure the critical data for. To enable that, an IMA policy
> option to choose specific kernel subsystems is needed. This policy option
> would constrain the measurement of the critical data to the given kernel
> subsystems.
Measuring critical data should not be dependent on the source of the
critical data. This patch needs to be split up. The "data sources"
should be move to it's own separate patch. This patch should be
limited to adding the policy code needed for measuring criticial data.
Limiting critical data sources should be the last patch in this series.
thanks,
Mimi
>
> Add a new IMA policy option - "data_sources:=" to the IMA func
> CRITICAL_DATA to allow measurement of various kernel subsystems. This
> policy option would enable the system administrators to limit the
> measurement to the subsystems listed in "data_sources:=", if the
> subsystem measures its data by calling ima_measure_critical_data().
>
> Limit the measurement to the subsystems that are specified in the IMA
> policy - CRITICAL_DATA+"data_sources:=". If "data_sources:=" is not
> provided with the func CRITICAL_DATA, measure the data from all the
> supported kernel subsystems.
>
> Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
next prev parent reply other threads:[~2020-11-06 13:43 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-01 22:26 [PATCH v5 0/7] IMA: Infrastructure for measurement of critical kernel data Tushar Sugandhi
2020-11-01 22:26 ` [PATCH v5 1/7] IMA: generalize keyring specific measurement constructs Tushar Sugandhi
2020-11-01 22:26 ` [PATCH v5 2/7] IMA: update process_buffer_measurement to measure buffer hash Tushar Sugandhi
2020-11-05 14:30 ` Mimi Zohar
2020-11-12 21:47 ` Tushar Sugandhi
2020-11-12 22:19 ` Mimi Zohar
2020-11-12 23:16 ` Tushar Sugandhi
2020-11-06 12:11 ` Mimi Zohar
2020-11-12 21:48 ` Tushar Sugandhi
2020-11-01 22:26 ` [PATCH v5 3/7] IMA: add hook to measure critical data Tushar Sugandhi
2020-11-06 13:24 ` Mimi Zohar
2020-11-12 21:57 ` Tushar Sugandhi
2020-11-12 23:56 ` Mimi Zohar
2020-11-13 17:23 ` Tushar Sugandhi
2020-11-01 22:26 ` [PATCH v5 4/7] IMA: add policy " Tushar Sugandhi
2020-11-06 13:43 ` Mimi Zohar [this message]
2020-11-12 22:02 ` Tushar Sugandhi
2020-11-01 22:26 ` [PATCH v5 5/7] IMA: validate supported kernel data sources before measurement Tushar Sugandhi
2020-11-06 14:01 ` Mimi Zohar
2020-11-12 22:09 ` Tushar Sugandhi
2020-11-13 0:06 ` Mimi Zohar
2020-11-01 22:26 ` [PATCH v5 6/7] IMA: add critical_data to the built-in policy rules Tushar Sugandhi
2020-11-06 15:24 ` Mimi Zohar
2020-11-06 15:37 ` Lakshmi Ramasubramanian
2020-11-06 23:51 ` Lakshmi Ramasubramanian
2020-11-08 15:46 ` Mimi Zohar
2020-11-09 17:24 ` Lakshmi Ramasubramanian
2020-11-01 22:26 ` [PATCH v5 7/7] selinux: measure state and hash of the policy using IMA Tushar Sugandhi
2020-11-06 15:47 ` Mimi Zohar
2020-11-05 0:31 ` [PATCH v5 0/7] IMA: Infrastructure for measurement of critical kernel data Mimi Zohar
2020-11-12 22:18 ` Tushar Sugandhi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6d835878af2f11c837633510775742e57a1506eb.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=agk@redhat.com \
--cc=casey@schaufler-ca.com \
--cc=dm-devel@redhat.com \
--cc=gmazyland@gmail.com \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=nramas@linux.microsoft.com \
--cc=paul@paul-moore.com \
--cc=sashal@kernel.org \
--cc=selinux@vger.kernel.org \
--cc=snitzer@redhat.com \
--cc=stephen.smalley.work@gmail.com \
--cc=tusharsu@linux.microsoft.com \
--cc=tyhicks@linux.microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).