[lkml]   [2010]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[PATCH v3 00/15] EVM
    Based on conversations on the SELinux mailing list with Stephan Smalley and
    Serge Hallyn as to EVM/IMA appraisal capabilities for setting xattrs, it was
    agreed, at least for the time being, they should require CAP_SYS_ADMIN, not
    CAP_MAC_ADMIN. Much appreciation to Stephan Smalley for resolving an EVM bug.
    Instead of calling __vfs_setxattr_noperm(), which doesn't do permission
    checking, EVM called setxattr() directly. Lastly, this patchset extends the
    policy language to allow rules to be defined in terms of file owner.

    Changelog summary v3:
    - Extends the policy language with 'owner'
    - Use CAP_SYS_ADMIN in lieu of CAP_MAC_ADMIN
    - Use __vfs_setxattr_noperm(), without permission checks, from EVM

    Changelog summary v2:
    - adds Documentation/ABI/testing/evm
    - removed leading blanks (
    - removed file trailing blank lines (git quiltimport)
    - added include files, where functions are first defined, to resolve
    'symbol not declared, should be static' (new sparse warnings)
    - fixed stub function definitions to be 'static inline' to resolve
    'defined but not used' gcc warnings.
    (More specific changelog details are in the individual patch descriptions.)

    fs summary:
    - Moves ima_iint.c up a layer to security/integrity and renames
    ima_inode_alloc/free hooks to integrity_inode_alloc/free
    - Defines 2 new generic functions: vfs_getxattr_alloc, vfs_xattr_cmp
    - Adds 3 EVM calls in the security hooks: evm_inode_setxattr(),
    evm_inode_post_setxattr(), evm_inode_removexattr
    - Defines 3 new calls: evm_inode_post_init(), evm_inode_post_setattr(),
    - Exports: evm_verifyxattr()
    - Defines 3 new IMA calls for IMA appraisal: ima_inode_setxattr(),
    ima_inode_removexattr(), and ima_inode_post_setattr()

    To address concerns of exposing the EVM key to userspace in plaintext
    (Eric Paris, Stephan Smalley), future work will define new key-types
    for use with TPM sealed keys and encrypted symmetric keys, so that on
    systems with a TPM, the EVM key will never be visible outside the kernel
    in plaintext form.

    Extended Verification Module(EVM) detects offline tampering of the
    security extended attributes (e.g. security.selinux, security.SMACK64,
    security.ima), which is the basis for LSM permission decisions and,
    with this set of patches, integrity appraisal decisions. To detect
    offline tampering of the extended attributes, EVM maintains an
    HMAC-sha1 across a set of security extended attributes, storing the
    HMAC as the extended attribute 'security.evm'. To verify the integrity
    of an extended attribute, EVM exports evm_verifyxattr(), which
    re-calculates the HMAC and compares it with the version stored in

    IMA currently maintains an integrity measurement list, containing
    the hashes of all executables, mmapped execute files, and files open
    for read by root (assuming the default measurement policy). The
    measurement list, with other information, can be used to assert the
    integrity of the running system to a third party. The "ima: integrity
    appraisal extension" patch extends IMA with local measurement
    appraisal. The extension stores and maintains the file integrity
    measurement as an extended attribute 'security.ima', which EVM can be
    configured to protect.

    DAC/MAC protect the integrity of a running system. An offline attack
    can bypass these protection mechanisms by mounting the disk under a
    different operating system and modifying the file data/metadata. If
    the disk is subsequently remounted under the EVM + DAC/MAC + IMA
    protected OS, then the hash of the file data won't match the hash stored
    in the IMA xattr, or the TPM-calculated HMAC of the file's metadata won't
    be valid. Therefore, IMA + MAC + EVM can protect system integrity online
    and detect offline tampering.

    This patch set applies to the security-testing/next tree. For more
    information on IMA/EVM, refer to

    Much appreciation to Dave Hansen, Serge Hallyn, and Matt Helsley for
    reviewing the patches.

    Mimi Zohar (15):
    integrity: move ima inode integrity data management
    xattr: define vfs_getxattr_alloc and vfs_xattr_cmp
    evm: re-release
    ima: move ima_file_free before releasing the file
    security: imbed evm calls in security hooks
    evm: inode post removexattr
    evm: imbed evm_inode_post_setattr
    evm: inode_post_init
    fs: add evm_inode_post_init calls
    ima: integrity appraisal extension
    ima: appraise default rules
    ima: inode post_setattr
    ima: add ima_inode_setxattr and ima_inode_removexattr
    ima: appraise measurement required
    ima: extend policy language to support owner

    Documentation/ABI/testing/evm | 22 +++
    Documentation/ABI/testing/ima_policy | 22 ++-
    Documentation/kernel-parameters.txt | 4 +
    fs/attr.c | 7 +-
    fs/ext2/xattr_security.c | 31 +++-
    fs/ext3/xattr_security.c | 30 +++-
    fs/ext4/xattr_security.c | 30 +++-
    fs/file_table.c | 2 +-
    fs/xattr.c | 63 ++++++-
    include/linux/evm.h | 82 ++++++++
    include/linux/ima.h | 30 ++-
    include/linux/integrity.h | 35 ++++
    include/linux/xattr.h | 17 ++-
    security/Kconfig | 2 +-
    security/Makefile | 4 +-
    security/integrity/Kconfig | 7 +
    security/integrity/Makefile | 12 ++
    security/integrity/evm/Kconfig | 13 ++
    security/integrity/evm/Makefile | 6 +
    security/integrity/evm/evm.h | 38 ++++
    security/integrity/evm/evm_crypto.c | 198 +++++++++++++++++++
    security/integrity/evm/evm_main.c | 336 +++++++++++++++++++++++++++++++++
    security/integrity/evm/evm_secfs.c | 108 +++++++++++
    security/integrity/iint.c | 153 +++++++++++++++
    security/integrity/ima/Kconfig | 16 ++
    security/integrity/ima/Makefile | 4 +-
    security/integrity/ima/ima.h | 77 +++++---
    security/integrity/ima/ima_api.c | 61 +++++--
    security/integrity/ima/ima_appraise.c | 151 +++++++++++++++
    security/integrity/ima/ima_iint.c | 146 --------------
    security/integrity/ima/ima_main.c | 153 +++++++++++++---
    security/integrity/ima/ima_policy.c | 84 ++++++++-
    security/integrity/integrity.h | 50 +++++
    security/security.c | 27 +++-
    34 files changed, 1758 insertions(+), 263 deletions(-)
    create mode 100644 Documentation/ABI/testing/evm
    create mode 100644 include/linux/evm.h
    create mode 100644 include/linux/integrity.h
    create mode 100644 security/integrity/Kconfig
    create mode 100644 security/integrity/Makefile
    create mode 100644 security/integrity/evm/Kconfig
    create mode 100644 security/integrity/evm/Makefile
    create mode 100644 security/integrity/evm/evm.h
    create mode 100644 security/integrity/evm/evm_crypto.c
    create mode 100644 security/integrity/evm/evm_main.c
    create mode 100644 security/integrity/evm/evm_secfs.c
    create mode 100644 security/integrity/iint.c
    create mode 100644 security/integrity/ima/ima_appraise.c
    delete mode 100644 security/integrity/ima/ima_iint.c
    create mode 100644 security/integrity/integrity.h

     \ /
      Last update: 2010-07-30 17:49    [W:0.028 / U:80.188 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site