linux-kernel - Re: [PATCH v15 00/11] LSM: Three basic syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 17 Oct 2023 09:01:15 +0200
From:   Roberto Sassu <roberto.sassu@...weicloud.com>
To:     Paul Moore <paul@...l-moore.com>
Cc:     Casey Schaufler <casey@...aufler-ca.com>,
        linux-security-module@...r.kernel.org, jmorris@...ei.org,
        serge@...lyn.com, keescook@...omium.org,
        john.johansen@...onical.com, penguin-kernel@...ove.sakura.ne.jp,
        stephen.smalley.work@...il.com, linux-kernel@...r.kernel.org,
        linux-api@...r.kernel.org, mic@...ikod.net
Subject: Re: [PATCH v15 00/11] LSM: Three basic syscalls

On Mon, 2023-10-16 at 11:06 -0400, Paul Moore wrote:
> On Mon, Oct 16, 2023 at 8:05 AM Roberto Sassu
> <roberto.sassu@...weicloud.com> wrote:
> > 
> > Sorry, I just noticed LSM_ID_IMA. Since we have the 'integrity' LSM, I
> > think it should be LSM_ID_INTEGRITY.
> > 
> > Mimi, all, do you agree? If yes, I send a patch shortly.
> 
> I believe LSM_ID_IMA is the better option, despite "integrity" already
> being present in Kconfig and possibly other areas.  "IMA" is a
> specific thing/LSM whereas "integrity" is a property, principle, or
> quality.  Especially as we move forward with promoting IMA as a full
> and proper LSM, we should work towards referring to it as "IMA" and
> not "integrity".
> 
> If anything we should be working to support "IMA" in places where we
> currently have "integrity" so that we can eventually deprecate
> "integrity".

Hi Paul

I fully understand your argument. However, 'integrity' has been the
word to identify the integrity subsystem since long time ago.

Reducing the scope to 'ima' would create some confusion since, while
'ima' is associated to integrity, it would not encompass EVM.

The term 'integrity', although it is a property, it precisely
identifies in the kernel context the scope and goals of the subsystem,
and is general enough to encompass new projects going in a similar
direction (such as my integrity digest cache).

>From a technical perspective, at the moment it is not possible to split
'integrity' in two standalone LSMs 'ima' and 'evm', as IMA and EVM work
on shared integrity metadata. Also my integrity digest cache is using
the same metadata.

In addition, making IMA and EVM as standalone LSMs would require a much
longer development cycle to make them use disjoint metadata and to
define proper communication interfaces. It would be not anymore a
technical move of function calls from a place to another, like for the
current patch set, but would require substantial time to validate the
new design.

To submit my patch set in the current state, the only thing I need is
to have LSM_ID_INTEGRITY defined.

Roberto