linux-kernel - Re: [PATCH v9 5/6] IMA: Add support to limit measuring keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89bb3226-3a2e-c7fa-fff9-3a422739481c@linux.microsoft.com>
Date:   Tue, 3 Dec 2019 15:37:17 -0800
From:   Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>
To:     Mimi Zohar <zohar@...ux.ibm.com>, linux-integrity@...r.kernel.org
Cc:     eric.snowberg@...cle.com, dhowells@...hat.com,
        matthewgarrett@...gle.com, sashal@...nel.org,
        jamorris@...ux.microsoft.com, linux-kernel@...r.kernel.org,
        keyrings@...r.kernel.org
Subject: Re: [PATCH v9 5/6] IMA: Add support to limit measuring keys

On 12/3/2019 12:06 PM, Mimi Zohar wrote:

> Suppose both root and uid 1000 define a keyring named "foo".  The
> current "keyrings=foo" will measure all keys added to either keyring
> named "foo".  There needs to be a way to limit measuring keys to a
> particular keyring named "foo".
> 
> Mimi

Thanks for clarifying.

Suppose two different non-root users create keyring with the same name 
"foo" and, say, both are measured, how would we know which keyring 
measurement belongs to which user?

Wouldn't it be sufficient to include only keyrings created by "root" 
(UID value 0) in the key measurement? This will include all the builtin 
trusted keyrings (such as .builtin_trusted_keys, 
.secondary_trusted_keys, .ima, .evm, etc.).

What would be the use case for including keyrings created by non-root 
users in key measurement?

Also, since the UID for non-root users can be any integer value (greater 
than 0), can an an administrator craft a generic IMA policy that would 
be applicable to all clients in an enterprise?

thanks,
  -lakshmi