linux-kernel - Re: [RFC 2/2] ima: Fix detection of read/write violations on stacked filesystems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 15 Apr 2024 14:34:56 -0400
From: Mimi Zohar <zohar@...ux.ibm.com>
To: Miklos Szeredi <miklos@...redi.hu>
Cc: Stefan Berger <stefanb@...ux.ibm.com>,
        Amir Goldstein
 <amir73il@...il.com>, linux-integrity@...r.kernel.org,
        linux-unionfs@...r.kernel.org, linux-kernel@...r.kernel.org,
        roberto.sassu@...wei.com, Christian Brauner <brauner@...nel.org>
Subject: Re: [RFC 2/2] ima: Fix detection of read/write violations on
 stacked filesystems

On Mon, 2024-04-15 at 14:57 +0200, Miklos Szeredi wrote:
> On Mon, 15 Apr 2024 at 12:47, Mimi Zohar <zohar@...ux.ibm.com> wrote:
> > It's queued in
> > https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/
> > next-
> > integrity branch and should be linux-next.
> 
> Is there a document about ima/evm vs. overlayfs?

Not yet.
> 
> What exactly is it trying to achieve and how?

Although "Changes to the underlying filesystems while part of a mounted overlay
filesystem are not allowed.", from an integrity perspective these changes might
affect overlay files.  So they need to be detected and possibly re-measured, re-
appraised, and/or re-audited [1, 2].

Saying, "If the underlying filesystem is changed, the behavior of the overlay is
undefined, though it will not result in a crash or deadlock." does not address
the concerns about the integrity of the overlay file being accessed.

Initially we disabled EVM on overlay, since calculating the overlay EVM HMAC,
could result in taking an invalid HMAC value and making it valid.  Stefan's EVM
patch set addresses this by only copying up the EVM portable & immutable
signature [3, 4].

Lastly, if a file is being opened for read, but is already opened for write, or
the reverse, the file measurement is meaningless.  A violation is audited and
the IMA measurement list is invalidated.  This patch set similarly addresses the
case where the underlying file is already opened for write and the overlay file
is being opened for read.

[1] Commit 18b44bc5a672 ("ovl: Always reevaluate the file signature for IMA")
forced signature re-evaulation on every file access.

[2] Commit b836c4d29f27 (ima: detect changes to the backing overlay file)

[3] 
https://lore.kernel.org/linux-integrity/20231219175206.12342-1-zohar@linux.ibm.com/

[4] 
https://lore.kernel.org/linux-integrity/20240223172513.4049959-1-stefanb@linux.ibm.com/

thanks,

Mimi