linux-kernel - Re: [RFC][PATCH 1/3] evm: Move hooks outside LSM infrastructure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1588957684.5146.70.camel@linux.ibm.com>
Date:   Fri, 08 May 2020 13:08:04 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Roberto Sassu <roberto.sassu@...wei.com>,
        "david.safford@...il.com" <david.safford@...il.com>,
        "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        John Johansen <john.johansen@...onical.com>
Cc:     "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Silviu Vlasceanu <Silviu.Vlasceanu@...wei.com>
Subject: Re: [RFC][PATCH 1/3] evm: Move hooks outside LSM infrastructure

On Fri, 2020-05-08 at 10:20 +0000, Roberto Sassu wrote:
> > From: Mimi Zohar [mailto:zohar@...ux.ibm.com]
> > On Thu, 2020-05-07 at 16:47 +0000, Roberto Sassu wrote:

<snip>

> > > > the file metadata to the file data.  The IMA and EVM policies really
> > > > need to be in sync.
> > >
> > > It would be nice, but at the moment EVM considers also files that are
> > > not selected by the IMA policy. An example of why this is a problem is
> > > the audit service that fails to start when it tries to adjust the permissions
> > > of the log files. Those files don't have security.evm because they are
> > > not appraised by IMA, but EVM denies the operation.
> > 
> > No, this is a timing issue as to whether or not the builtin policy or
> > a custom policy has been loaded.  A custom policy could exclude the
> > log files based on LSM labels, but they are included in the builtin
> > policy.
> 
> Yes, I was referring to a custom policy. In this case, EVM will not adapt
> to the custom policy but still verifies all files. If access control is done
> exclusively by IMA at the time evm_verifyxattr() is called, we wouldn't
> need to add security.evm to all files.

Roberto, EVM is only triggered by IMA, unless you've modified the
kernel to do otherwise.

I'm not interested in a complicated solution, just one that addresses
the new EVM immutable and portable signature.  It might require EVM
HMAC, IMA differentiating between a new file and an existing file, or
it might require writing the new EVM signature last, after all the
other xattrs or metadata are updated.  Please nothing that changes
existing expectations.

Mimi