linux-kernel - Re: [PATCH v6 00/15] integrity: Introduce the Integrity Digest Cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <C4BE31F8-1FA3-4AD1-A712-ED2AA7E61E96@oracle.com>
Date: Tue, 26 Nov 2024 00:13:51 +0000
From: Eric Snowberg <eric.snowberg@...cle.com>
To: Roberto Sassu <roberto.sassu@...weicloud.com>
CC: Mimi Zohar <zohar@...ux.ibm.com>,
        Dmitry Kasatkin
	<dmitry.kasatkin@...il.com>,
        "corbet@....net" <corbet@....net>,
        "mcgrof@...nel.org" <mcgrof@...nel.org>,
        "petr.pavlu@...e.com"
	<petr.pavlu@...e.com>,
        "samitolvanen@...gle.com" <samitolvanen@...gle.com>,
        "da.gomez@...sung.com" <da.gomez@...sung.com>,
        Andrew Morton
	<akpm@...ux-foundation.org>,
        "paul@...l-moore.com" <paul@...l-moore.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com"
	<serge@...lyn.com>,
        "shuah@...nel.org" <shuah@...nel.org>,
        "mcoquelin.stm32@...il.com" <mcoquelin.stm32@...il.com>,
        "alexandre.torgue@...s.st.com" <alexandre.torgue@...s.st.com>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-api@...r.kernel.org" <linux-api@...r.kernel.org>,
        "linux-modules@...r.kernel.org" <linux-modules@...r.kernel.org>,
        "linux-security-module@...r.kernel.org"
	<linux-security-module@...r.kernel.org>,
        "linux-kselftest@...r.kernel.org"
	<linux-kselftest@...r.kernel.org>,
        "wufan@...ux.microsoft.com"
	<wufan@...ux.microsoft.com>,
        "pbrobinson@...il.com" <pbrobinson@...il.com>,
        "zbyszek@...waw.pl" <zbyszek@...waw.pl>, "hch@....de" <hch@....de>,
        "mjg59@...f.ucam.org" <mjg59@...f.ucam.org>,
        "pmatilai@...hat.com"
	<pmatilai@...hat.com>,
        "jannh@...gle.com" <jannh@...gle.com>,
        "dhowells@...hat.com" <dhowells@...hat.com>,
        "jikos@...nel.org"
	<jikos@...nel.org>,
        "mkoutny@...e.com" <mkoutny@...e.com>,
        "ppavlu@...e.com"
	<ppavlu@...e.com>,
        "petr.vorel@...il.com" <petr.vorel@...il.com>,
        "mzerqung@...inter.de" <mzerqung@...inter.de>,
        "kgold@...ux.ibm.com"
	<kgold@...ux.ibm.com>,
        Roberto Sassu <roberto.sassu@...wei.com>
Subject: Re: [PATCH v6 00/15] integrity: Introduce the Integrity Digest Cache



> On Nov 19, 2024, at 3:49 AM, Roberto Sassu <roberto.sassu@...weicloud.com> wrote:
> 
> From: Roberto Sassu <roberto.sassu@...wei.com>
> 
> The Integrity Digest Cache can also help IMA for appraisal. IMA can simply
> lookup the calculated digest of an accessed file in the list of digests
> extracted from package headers, after verifying the header signature. It is
> sufficient to verify only one signature for all files in the package, as
> opposed to verifying a signature for each file.

Is there a way to maintain integrity over time?  Today if a CVE is discovered 
in a signed program, the program hash can be added to the blacklist keyring. 
Later if IMA appraisal is used, the signature validation will fail just for that 
program.  With the Integrity Digest Cache, is there a way to do this?