linux-kernel - Re: [PATCH] ima: remove template "ima" as the compiled default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7831693e-f923-043e-6097-17052eb83f7e@huawei.com>
Date:   Thu, 24 Mar 2022 09:20:12 +0800
From:   "Guozihua (Scott)" <guozihua@...wei.com>
To:     <linux-integrity@...r.kernel.org>
CC:     <zohar@...ux.ibm.com>, <dmitry.kasatkin@...il.com>,
        <roberto.sassu@...wei.com>,
        <linux-security-module@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <xiujianfeng@...wei.com>,
        <wangweiyang2@...wei.com>
Subject: Re: [PATCH] ima: remove template "ima" as the compiled default

On 2022/3/21 15:47, GUO Zihua wrote:
> Template "ima" is a legacy template which limits the hash algorithm to
> either sha1 or md5. None of them should be considered "strong" these
> days. Besides, allowing template "ima" as the compiled default would
> also cause the following issue: the cmdline option "ima_hash=" must be
> behind "ima_template=", otherwise "ima_hash=" might be rejected.
> 
> The root cause of this issue is that during the processing of ima_hash,
> we would try to check whether the hash algorithm is compatible with the
> template. If the template is not set at the moment we do the check, we
> check the algorithm against the compiled default template. If the
> complied default template is "ima", then we reject any hash algorithm
> other than sha1 and md5.
> 
> For example, if the compiled default template is "ima", and the default
> algorithm is sha1 (which is the current default). In the cmdline, we put
> in "ima_hash=sha256 ima_template=ima-ng". The expected behavior would be
> that ima starts with ima-ng as the template and sha256 as the hash
> algorithm. However, during the processing of "ima_hash=",
> "ima_template=" has not been processed yet, and hash_setup would check
> the configured hash algorithm against the compiled default: ima, and
> reject sha256. So at the end, the hash algorithm that is actually used
> will be sha1.
> 
> With template "ima" removed from the compiled default, we ensure that the
> default tempalte would at least be "ima-ng" which allows for basically
> any hash algorithm.
> 
> This change would not break the algorithm compatibility checking for
> IMA.
> 
> Fixes: 4286587dccd43 ("ima: add Kconfig default measurement list template")
> Signed-off-by: GUO Zihua <guozihua@...wei.com>
> ---
>   security/integrity/ima/Kconfig | 14 +++++---------
>   1 file changed, 5 insertions(+), 9 deletions(-)
> 
> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> index f3a9cc201c8c..9513df2ac19e 100644
> --- a/security/integrity/ima/Kconfig
> +++ b/security/integrity/ima/Kconfig
> @@ -65,14 +65,11 @@ choice
>   	help
>   	  Select the default IMA measurement template.
>   
> -	  The original 'ima' measurement list template contains a
> -	  hash, defined as 20 bytes, and a null terminated pathname,
> -	  limited to 255 characters.  The 'ima-ng' measurement list
> -	  template permits both larger hash digests and longer
> -	  pathnames.
> -
> -	config IMA_TEMPLATE
> -		bool "ima"
> +	  The 'ima-ng' measurement list template permits various hash
> +	  digests and long pathnames. The compiled default template
> +	  can be overwritten using the kernel command line
> +	  'ima_template=' option.
> +
>   	config IMA_NG_TEMPLATE
>   		bool "ima-ng (default)"
>   	config IMA_SIG_TEMPLATE
> @@ -82,7 +79,6 @@ endchoice
>   config IMA_DEFAULT_TEMPLATE
>   	string
>   	depends on IMA
> -	default "ima" if IMA_TEMPLATE
>   	default "ima-ng" if IMA_NG_TEMPLATE
>   	default "ima-sig" if IMA_SIG_TEMPLATE
>   

Hi all,

Any thought on this patch?

Thanks!

-- 
Best
GUO Zihua