linux-kernel - Re: [PATCH v6 00/15] integrity: Introduce the Integrity Digest Cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <17ef4f662e594c8431a00fe423507af4f6a82286.camel@huaweicloud.com>
Date: Tue, 26 Nov 2024 11:41:44 +0100
From: Roberto Sassu <roberto.sassu@...weicloud.com>
To: Eric Snowberg <eric.snowberg@...cle.com>
Cc: Mimi Zohar <zohar@...ux.ibm.com>, Dmitry Kasatkin
 <dmitry.kasatkin@...il.com>, "corbet@....net" <corbet@....net>, 
 "mcgrof@...nel.org" <mcgrof@...nel.org>, "petr.pavlu@...e.com"
 <petr.pavlu@...e.com>,  "samitolvanen@...gle.com"
 <samitolvanen@...gle.com>, "da.gomez@...sung.com" <da.gomez@...sung.com>, 
 Andrew Morton <akpm@...ux-foundation.org>, "paul@...l-moore.com"
 <paul@...l-moore.com>, "jmorris@...ei.org" <jmorris@...ei.org>,
 "serge@...lyn.com" <serge@...lyn.com>, "shuah@...nel.org"
 <shuah@...nel.org>, "mcoquelin.stm32@...il.com"
 <mcoquelin.stm32@...il.com>,  "alexandre.torgue@...s.st.com"
 <alexandre.torgue@...s.st.com>, "linux-integrity@...r.kernel.org"
 <linux-integrity@...r.kernel.org>, "linux-doc@...r.kernel.org"
 <linux-doc@...r.kernel.org>, "linux-kernel@...r.kernel.org"
 <linux-kernel@...r.kernel.org>, "linux-api@...r.kernel.org"
 <linux-api@...r.kernel.org>, "linux-modules@...r.kernel.org"
 <linux-modules@...r.kernel.org>, "linux-security-module@...r.kernel.org"
 <linux-security-module@...r.kernel.org>, "linux-kselftest@...r.kernel.org"
 <linux-kselftest@...r.kernel.org>, "wufan@...ux.microsoft.com"
 <wufan@...ux.microsoft.com>, "pbrobinson@...il.com" <pbrobinson@...il.com>,
  "zbyszek@...waw.pl" <zbyszek@...waw.pl>, "hch@....de" <hch@....de>,
 "mjg59@...f.ucam.org" <mjg59@...f.ucam.org>, "pmatilai@...hat.com"
 <pmatilai@...hat.com>,  "jannh@...gle.com" <jannh@...gle.com>,
 "dhowells@...hat.com" <dhowells@...hat.com>,  "jikos@...nel.org"
 <jikos@...nel.org>, "mkoutny@...e.com" <mkoutny@...e.com>,
 "ppavlu@...e.com" <ppavlu@...e.com>, "petr.vorel@...il.com"
 <petr.vorel@...il.com>,  "mzerqung@...inter.de" <mzerqung@...inter.de>,
 "kgold@...ux.ibm.com" <kgold@...ux.ibm.com>, Roberto Sassu
 <roberto.sassu@...wei.com>
Subject: Re: [PATCH v6 00/15] integrity: Introduce the Integrity Digest Cache

On Tue, 2024-11-26 at 00:13 +0000, Eric Snowberg wrote:
> 
> > On Nov 19, 2024, at 3:49 AM, Roberto Sassu <roberto.sassu@...weicloud.com> wrote:
> > 
> > From: Roberto Sassu <roberto.sassu@...wei.com>
> > 
> > The Integrity Digest Cache can also help IMA for appraisal. IMA can simply
> > lookup the calculated digest of an accessed file in the list of digests
> > extracted from package headers, after verifying the header signature. It is
> > sufficient to verify only one signature for all files in the package, as
> > opposed to verifying a signature for each file.
> 
> Is there a way to maintain integrity over time?  Today if a CVE is discovered 
> in a signed program, the program hash can be added to the blacklist keyring. 
> Later if IMA appraisal is used, the signature validation will fail just for that 
> program.  With the Integrity Digest Cache, is there a way to do this?  

As far as I can see, the ima_check_blacklist() call is before
ima_appraise_measurement(). If it fails, appraisal with the Integrity
Digest Cache will not be done.

In the future, we might use the Integrity Digest Cache for blacklists
too. Since a digest cache is reset on a file/directory change, IMA
would have to revalidate the program digest against a new digest cache.

Thanks

Roberto