linux-kernel - Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ac0d0d8f3d40ec3f7279f3ece0e75d0b2ec32b4e.camel@huaweicloud.com>
Date: Thu, 19 Dec 2024 16:40:32 +0100
From: Roberto Sassu <roberto.sassu@...weicloud.com>
To: Song Liu <songliubraving@...a.com>, Mimi Zohar <zohar@...ux.ibm.com>
Cc: Casey Schaufler <casey@...aufler-ca.com>, Song Liu <song@...nel.org>, 
	"linux-fsdevel@...r.kernel.org"
	 <linux-fsdevel@...r.kernel.org>, "linux-integrity@...r.kernel.org"
	 <linux-integrity@...r.kernel.org>, "linux-security-module@...r.kernel.org"
	 <linux-security-module@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	 <linux-kernel@...r.kernel.org>, "roberto.sassu@...wei.com"
	 <roberto.sassu@...wei.com>, "dmitry.kasatkin@...il.com"
	 <dmitry.kasatkin@...il.com>, "eric.snowberg@...cle.com"
	 <eric.snowberg@...cle.com>, "paul@...l-moore.com" <paul@...l-moore.com>, 
	"jmorris@...ei.org"
	 <jmorris@...ei.org>, "serge@...lyn.com" <serge@...lyn.com>, Kernel Team
	 <kernel-team@...a.com>, "brauner@...nel.org" <brauner@...nel.org>, 
	"jack@...e.cz"
	 <jack@...e.cz>, "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>
Subject: Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable
 IMA/EVM

On Wed, 2024-12-18 at 17:07 +0000, Song Liu wrote:
> Hi Mimi, 
> 
> Thanks for your comments!
> 
> > On Dec 18, 2024, at 3:02 AM, Mimi Zohar <zohar@...ux.ibm.com> wrote:
> > 
> > On Tue, 2024-12-17 at 13:29 -0800, Casey Schaufler wrote:
> > > On 12/17/2024 12:25 PM, Song Liu wrote:
> > > > While reading and testing LSM code, I found IMA/EVM consume per inode
> > > > storage even when they are not in use. Add options to diable them in
> > > > kernel command line. The logic and syntax is mostly borrowed from an
> > > > old serious [1].
> > > 
> > > Why not omit ima and evm from the lsm= parameter?
> > 
> > Casey, Paul, always enabling IMA & EVM as the last LSMs, if configured, were the
> > conditions for making IMA and EVM LSMs.  Up to that point, only when an inode
> > was in policy did it consume any memory (rbtree).  I'm pretty sure you remember
> > the rather heated discussion(s).
> 
> I didn't know about this history until today. I apologize if this 
> RFC/PATCH is moving to the direction against the original agreement. 
> I didn't mean to break any agreement. 
> 
> My motivation is actually the per inode memory consumption of IMA 
> and EVM. Once enabled, EVM appends a whole struct evm_iint_cache to 
> each inode via i_security. IMA is better on memory consumption, as 
> it only adds a pointer to i_security. 
> 
> It appears to me that a way to disable IMA and EVM at boot time can 
> be useful, especially for distro kernels. But I guess there are 
> reasons to not allow this (thus the earlier agreement). Could you 
> please share your thoughts on this?

Hi Song

IMA/EVM cannot be always disabled for two reasons: (1) for secure and
trusted boot, IMA is expected to enforce architecture-specific
policies; (2) accidentally disabling them will cause modified files to
be rejected when IMA/EVM are turned on again.

If the requirements above are met, we are fine on disabling IMA/EVM.

As for reserving space in the inode security blob, please refer to this
discussion, where we reached the agreement:

https://lore.kernel.org/linux-integrity/CAHC9VhTTKac1o=RnQadu2xqdeKH8C_F+Wh4sY=HkGbCArwc8JQ@mail.gmail.com/

Thanks

Roberto