lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 10 Sep 2017 03:13:23 -0400
From:   Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:     "Theodore Ts'o" <tytso@....edu>, James Morris <jmorris@...ei.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        LSM List <linux-security-module@...r.kernel.org>,
        Christoph Hellwig <hch@...radead.org>
Subject: Re: [GIT PULL] Security subsystem updates for 4.14

On Fri, 2017-09-08 at 18:38 -0400, Theodore Ts'o wrote:
> On Fri, Sep 08, 2017 at 02:48:51PM +1000, James Morris wrote:
> > 
> > Mimi and Christoph worked together on this over several iterations -- I'll 
> > let them respond.
> 
> Mimi --- we should chat next week in LA.  I've been working on a
> design internally at work which proposes a generic VFS-layer library
> (ala how fscrypt in fs/crypto works) which provides data integrity
> using per-file Merkle trees.
> 
> The goals of this design:
> 
>    * Simplicity; for ease in security review and upstream review and
>      acceptance
>    * Useful for multiple use cases.  It is *not* Android/APK specific,
>      and indeed can be used for other things
>       * A better way of providing Linux IMA/EVM support for immutable
>         files by moving the verification from time-of-open to
>         time-of-readpage.  (This significantly reduces the performance
> 	impact, since we don't need to lock down the file while the kernel
> 	needs to run SHA1 on potentially gigabytes worth of file data.)
>       * Most use cases for file-level checksums are for files that
>         don’t change over time (e.g., for Video, Audio, Backup files,
>         etc.)  This allows us to provide a cheap and efficient way to
>         provide checksum protect against storage-level corruption
>         fairly easily.  So by supporting both SHA and CRC-32, we can
> 	make this feature useful for more than just the security heads.  :-)
>    * Like the encryption/fscrypt feature, most of the code to this
>      feature can be in a VFS-level library, with minimal hooks needed
>      to those file systems (ext4, f2fs) that wish to provide this
>      functionality.

>From a file integrity perspective this would be interesting, but that
only addresses IMA-appraisal, not IMA-integrity or IMA-audit.  We
would still need to calculate the file hash to be included in the
measurement list and used for auditing.

Have you done any work on protecting the directory information itself
(eg. file names) using Merkle trees?

Mimi

Powered by blists - more mailing lists