linux-kernel - Re: [PATCH v9 5/8] IMA: limit critical data measurement based on a label

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56db41c08d625b8143454a2e0aaaef3ea2927442.camel@linux.ibm.com>
Date:   Thu, 24 Dec 2020 09:29:50 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Tushar Sugandhi <tusharsu@...ux.microsoft.com>,
        stephen.smalley.work@...il.com, casey@...aufler-ca.com,
        agk@...hat.com, snitzer@...hat.com, gmazyland@...il.com,
        paul@...l-moore.com
Cc:     tyhicks@...ux.microsoft.com, sashal@...nel.org, jmorris@...ei.org,
        nramas@...ux.microsoft.com, linux-integrity@...r.kernel.org,
        selinux@...r.kernel.org, linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, dm-devel@...hat.com
Subject: Re: [PATCH v9 5/8] IMA: limit critical data measurement based on a
 label

Hi Tushar,

On Sat, 2020-12-12 at 10:02 -0800, Tushar Sugandhi wrote:
> System administrators should be able to limit which kernel subsystems
> they want to measure the critical data for. To enable that, an IMA policy
> condition to choose specific kernel subsystems is needed. This policy
> condition would constrain the measurement of the critical data based on
> a label for the given subsystems.

Restricting which kernel integrity critical data is measured is not
only of interest to system administrators.   Why single them out?

Limiting which critical data is measured is based on a label, making it
flexible.  In your use case scenario, you're grouping the label based
on kernel subsystem, but is that really necessary?  In the broader
picture, there could be cross subsystem critical data being measured
based on a single label.

Please think about the broader picture and re-write the patch
descirption more generically.

> 
> Add a new IMA policy condition - "data_source:=" to the IMA func

What is with "add"?  You're "adding support for" or "defining" a new
policy condition.  Remove the single hyphen, as explained in 3/8.

Please replace "data_source" with something more generic (e.g. label).

thanks,

Mimi

> CRITICAL_DATA to allow measurement of various kernel subsystems. This
> policy condition would enable the system administrators to restrict the
> measurement to the labels listed in "data_source:=".
> 
> Limit the measurement to the labels that are specified in the IMA
> policy - CRITICAL_DATA+"data_source:=". If "data_sources:=" is not
> provided with the func CRITICAL_DATA, the data from all the
> supported kernel subsystems is measured.
> 
> Signed-off-by: Tushar Sugandhi <tusharsu@...ux.microsoft.com>