linux-kernel - Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <358F6A59-C8ED-4CD6-996C-C68B3034B3F7@fb.com>
Date: Thu, 19 Dec 2024 17:46:52 +0000
From: Song Liu <songliubraving@...a.com>
To: Roberto Sassu <roberto.sassu@...weicloud.com>
CC: Song Liu <songliubraving@...a.com>, Mimi Zohar <zohar@...ux.ibm.com>,
        Casey Schaufler <casey@...aufler-ca.com>, Song Liu <song@...nel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org"
	<linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "roberto.sassu@...wei.com"
	<roberto.sassu@...wei.com>,
        "dmitry.kasatkin@...il.com"
	<dmitry.kasatkin@...il.com>,
        "eric.snowberg@...cle.com"
	<eric.snowberg@...cle.com>,
        "paul@...l-moore.com" <paul@...l-moore.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com"
	<serge@...lyn.com>,
        Kernel Team <kernel-team@...a.com>,
        "brauner@...nel.org"
	<brauner@...nel.org>,
        "jack@...e.cz" <jack@...e.cz>,
        "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>
Subject: Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

Hi Roberto, 

Thanks for sharing these information!

> On Dec 19, 2024, at 7:40 AM, Roberto Sassu <roberto.sassu@...weicloud.com> wrote:

[...]

>> I didn't know about this history until today. I apologize if this 
>> RFC/PATCH is moving to the direction against the original agreement. 
>> I didn't mean to break any agreement. 
>> 
>> My motivation is actually the per inode memory consumption of IMA 
>> and EVM. Once enabled, EVM appends a whole struct evm_iint_cache to 
>> each inode via i_security. IMA is better on memory consumption, as 
>> it only adds a pointer to i_security. 
>> 
>> It appears to me that a way to disable IMA and EVM at boot time can 
>> be useful, especially for distro kernels. But I guess there are 
>> reasons to not allow this (thus the earlier agreement). Could you 
>> please share your thoughts on this?
> 
> Hi Song
> 
> IMA/EVM cannot be always disabled for two reasons: (1) for secure and
> trusted boot, IMA is expected to enforce architecture-specific
> policies; (2) accidentally disabling them will cause modified files to
> be rejected when IMA/EVM are turned on again.
> 
> If the requirements above are met, we are fine on disabling IMA/EVM.

I probably missed something, but it appears to me IMA/EVM might be 
enabled in distro kernels, but the distro by default does not 
configure IMA/EVM, so they are not actually used. Did I misunderstand 
something?

> As for reserving space in the inode security blob, please refer to this
> discussion, where we reached the agreement:
> 
> https://lore.kernel.org/linux-integrity/CAHC9VhTTKac1o=RnQadu2xqdeKH8C_F+Wh4sY=HkGbCArwc8JQ@mail.gmail.com/

AFAICT, the benefit of i_security storage is its ability to be 
configured at boot time. If IMA/EVM cannot be disabled, it is 
better to add them to struct inode within a "#ifdef CONFIG_"
block. 

Thanks,
Song