linux-kernel - Re: [PATCH 3/4] integrity: IMA as an integrity service provider

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1227214371.2819.50.camel@localhost.localdomain>
Date:	Thu, 20 Nov 2008 15:52:51 -0500
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Christoph Hellwig <hch@...radead.org>
Cc:	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	James Morris <jmorris@...ei.org>,
	Al Viro <viro@...IV.linux.org.uk>,
	David Safford <safford@...son.ibm.com>,
	Serge Hallyn <serue@...ux.vnet.ibm.com>,
	Mimi Zohar <zohar@...ibm.com>
Subject: Re: [PATCH 3/4] integrity: IMA as an integrity service provider

On Thu, 2008-11-20 at 13:15 -0500, Christoph Hellwig wrote:

> > +		if (!rc) {
> > +			if (atomic_read(&(data->dentry->d_count)) - 1 >
> > +			    atomic_read(&(inode->i_writecount)))
> > +				ima_add_violation(inode, data->filename,
> > +						  "invalid_pcr", "ToMToU");
> > +		}
> 
> > +			if (atomic_read(&(inode->i_writecount)) > 0)
> > +				ima_add_violation(inode, data->filename,
> > +						  "invalid_pcr",
> > +						  "open_writers");
> 
> All these d_count and i_writecount access needs a lot of explanation,
> they certainly don't make sense as-is, but I'd like to find out what
> you're actually trying to do here.

The OS protects against an executable file, already open for write, from
being executed; and an executable file, open for execute, from being
modified.  In the same vein, we want to know that the file measured is
the same file read, that it hasn't been modified.  So, if a file already
open for read is then opened for write, we log it with a "Time of
Measure, Time of Use" error (ToMToU) and invalidate the PCR. Or, if a
file already open for write is then opened for read, we log the fact
that the file could change while being read and invalidate the PCR.

This is important when measuring configuration files, shell scripts (not
measured in brpm_check_integrity which are protected by the OS), and
files imported/included by scripts.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/