linux-kernel - Re: [PATCH 0/4] ima: support fs-verity signatures stored as

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 29 Nov 2021 18:36:55 -0800
From:   Eric Biggers <ebiggers@...nel.org>
To:     Mimi Zohar <zohar@...ux.ibm.com>
Cc:     linux-integrity@...r.kernel.org, linux-fscrypt@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/4] ima: support fs-verity signatures stored as

On Mon, Nov 29, 2021 at 12:00:53PM -0500, Mimi Zohar wrote:
> Support for fs-verity file digests in IMA was discussed from the beginning,
> prior to fs-verity being upstreamed[1,2].  This patch set adds signature
> verification support based on the fs-verity file digest.  Both the
> file digest and the signature must be included in the IMA measurement list
> in order to disambiguate the type of file digest.
> 
> [1] https://events19.linuxfoundation.org/wp-content/uploads/2017/11/fs-verify_Mike-Halcrow_Eric-Biggers.pdf
> [2] Documentation/filesystems/fsverity.rst
> 
> Mimi Zohar (4):
>   fs-verity: define a function to return the integrity protected file
>     digest
>   ima: define a new signature type named IMA_VERITY_DIGSIG
>   ima: limit including fs-verity's file digest in measurement list
>   ima: support fs-verity file digest based signatures
> 
>  fs/verity/fsverity_private.h              |  6 ---
>  fs/verity/measure.c                       | 49 +++++++++++++++++++++++
>  include/linux/fsverity.h                  | 17 ++++++++
>  security/integrity/ima/ima.h              |  3 +-
>  security/integrity/ima/ima_api.c          | 23 ++++++++++-
>  security/integrity/ima/ima_appraise.c     |  9 ++++-
>  security/integrity/ima/ima_main.c         |  7 +++-
>  security/integrity/ima/ima_template_lib.c |  3 +-
>  security/integrity/integrity.h            |  1 +
>  9 files changed, 107 insertions(+), 11 deletions(-)

I left some comments, but this generally looks like the right approach.
However, I'm not an expert in IMA, so it's hard for me to review the IMA parts.

Can you add documentation for this feature?

- Eric