linux-kernel - Re: [PATCH 2/2] ima: Support appraise_type=imasig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130213165922.GD6750@redhat.com>
Date:	Wed, 13 Feb 2013 11:59:22 -0500
From:	Vivek Goyal <vgoyal@...hat.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	"Kasatkin, Dmitry" <dmitry.kasatkin@...el.com>,
	linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] ima: Support appraise_type=imasig_optional

On Wed, Feb 13, 2013 at 08:44:04AM -0500, Mimi Zohar wrote:

[..]
> > I see it is more logical if it is "appraise_type=optional",
> > which means that we might have no xattr value, hash or signature.
> > It if happens to be a signature, then IMA_DIGSIG flag will be set.
> 
> Right, 'appraise_type=' could have been defined either as a comma
> separated list of options (eg. appraise_type=imassig,optional) or, as
> Vivek implemented, a new option.  Eventually, we will need to extend
> 'appraise_type=' (eg. required algorithm), but for now I don't have a
> problem with the new option.

Ok, I will cleanup the code to do above. Just wanted to clear up one
point. 

Above option will not have any effect on evm behavior? This only impacts
IMA appraisal behavior. For example, if security.ima is not present it
is fine and file access is allowed. But if EVM is enabled and initialized
and EVM does not find security.evm label (INTEGRITY_NOLABEL) or returns
INTEGRITY_NOXATTRS, file access should still be denied?

BTW, what's the difference between INTEGRITY_NOLABEL and
INTEGRITY_NOXATTRS (as returned by evm_verifyxattr()).

If yes, we probbaly need to differentiate between IMA/EVM nolabel. Say,
INTEGRITY_IMA_NOLABEL and INTEGRITY_EVM_NOLABEL. appraise_type=optional
should allow file access if rc = INTEGRITY_IMA_NOLABEL but deny it
when rc = INTEGRITY_EVM_NOLABEL?

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/