linux-kernel - Re: [PATCH v4] IMA: support for duplicate measurement records

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 May 2021 16:35:04 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Tushar Sugandhi <tusharsu@...ux.microsoft.com>
Cc:     tyhicks@...ux.microsoft.com, sashal@...nel.org, jmorris@...ei.org,
        nramas@...ux.microsoft.com, linux-integrity@...r.kernel.org,
        linux-kernel@...r.kernel.org, pvorel@...e.cz
Subject: Re: [PATCH v4] IMA: support for duplicate measurement records

Hi Tushar,

On Mon, 2021-05-10 at 12:09 -0700, Tushar Sugandhi wrote:
> IMA measures contents of a given file/buffer/critical-data record,
> and properly re-measures it on change.  However, IMA does not measure
> the duplicate value for a given record, since TPM extend is a very
> expensive operation.  For example, if the record changes from value
> 'v#1' to 'v#2', and then back to 'v#1', IMA will not measure and log
> the last change to 'v#1', since the hash of 'v#1' for that record is
> already present in the IMA htable.  This limits the ability of an
> external attestation service to accurately determine the current state
> of the system.  The service would incorrectly conclude that the latest
> value of the given record on the system is 'v#2', and act accordingly.
> 
> Define and use a new Kconfig option IMA_DISABLE_HTABLE to permit
> duplicate records in the IMA measurement list.
> 
> In addition to the duplicate measurement records described above,
> other duplicate file measurement records may be included in the log,
> when CONFIG_IMA_DISABLE_HTABLE=y.
> For example,
>     - i_version is not enabled,
>     - i_generation changed,
>     - an inode is evicted from dcache etc.

Missing from this list are the same file, perhaps on different
filesystmes, such as initramfs and real root.  These can be identified
by the different i_ino.  Is there anything else?

thanks,

Mimi

> 
> Signed-off-by: Tushar Sugandhi <tusharsu@...ux.microsoft.com>
> Reviewed-by: Petr Vorel <pvorel@...e.cz>