linux-kernel - [PATCH v2 00/12] IMA/EVM fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200904092339.19598-1-roberto.sassu@huawei.com>
Date:   Fri, 4 Sep 2020 11:23:27 +0200
From:   Roberto Sassu <roberto.sassu@...wei.com>
To:     <zohar@...ux.ibm.com>, <mjg59@...gle.com>
CC:     <linux-integrity@...r.kernel.org>,
        <linux-security-module@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <silviu.vlasceanu@...wei.com>,
        Roberto Sassu <roberto.sassu@...wei.com>
Subject: [PATCH v2 00/12] IMA/EVM fixes

This patch set includes various fixes for IMA and EVM.

Patches 1-3 are trivial fixes. The remaining improve support and usability
of EVM portable signatures. In particular patch 4 allows EVM to be used
without an HMAC key. Patch 5 avoids appraisal verification of public keys
(they are already verified by the key subsystem).

Patches 6-7 allow metadata verification to be turned off when the HMAC key
is not already loaded and to use this mode in a safe way (by ensuring that
IMA revalidates metadata when there is a change).

Patches 8-9 make portable signatures more usable if metadata verification
cannot be turned off (because the HMAC key is loaded) by accepting any
metadata modification until signature verification succeeds (useful when
xattrs/attrs are copied in a sequence from a source) and by allowing
operations that don't change metadata.

Patch 10 makes it possible to use portable signatures when the IMA policy
requires file signatures and patch 11 shows portable signatures when the
ima-sig measurement list template is selected.

Lastly, patch 12 avoids undesired removal of security.ima when a file is
not selected by the IMA policy.

Roberto Sassu (12):
  ima: Don't ignore errors from crypto_shash_update()
  ima: Remove semicolon at the end of ima_get_binary_runtime_size()
  evm: Check size of security.evm before using it
  evm: Execute evm_inode_init_security() only when the HMAC key is
    loaded
  evm: Load EVM key in ima_load_x509() to avoid appraisal
  evm: Refuse EVM_ALLOW_METADATA_WRITES only if the HMAC key is loaded
  evm: Introduce EVM_RESET_STATUS atomic flag
  evm: Allow xattr/attr operations for portable signatures if check
    fails
  evm: Allow setxattr() and setattr() if metadata digest won't change
  ima: Allow imasig requirement to be satisfied by EVM portable
    signatures
  ima: Introduce template field evmsig and write to field sig as
    fallback
  ima: Don't remove security.ima if file must not be appraised

 Documentation/ABI/testing/evm             |   6 +-
 Documentation/security/IMA-templates.rst  |   4 +-
 include/linux/integrity.h                 |   1 +
 security/integrity/evm/evm_main.c         | 151 ++++++++++++++++++++--
 security/integrity/evm/evm_secfs.c        |   2 +-
 security/integrity/iint.c                 |   2 +
 security/integrity/ima/ima_appraise.c     |  26 ++--
 security/integrity/ima/ima_crypto.c       |   2 +
 security/integrity/ima/ima_init.c         |   4 +
 security/integrity/ima/ima_main.c         |   8 +-
 security/integrity/ima/ima_queue.c        |   2 +-
 security/integrity/ima/ima_template.c     |   2 +
 security/integrity/ima/ima_template_lib.c |  39 +++++-
 security/integrity/ima/ima_template_lib.h |   2 +
 security/integrity/integrity.h            |   1 +
 15 files changed, 225 insertions(+), 27 deletions(-)

-- 
2.27.GIT