Messages in this thread | | | Date | Fri, 8 Aug 2008 13:06:13 -0700 | From | Randy Dunlap <> | Subject | Re: [PATCH 4/4] integrity: IMA as an integrity service provider |
| |
On Fri, 08 Aug 2008 14:56:36 -0400 Mimi Zohar wrote:
> Index: security-testing-2.6/Documentation/kernel-parameters.txt > =================================================================== > --- security-testing-2.6.orig/Documentation/kernel-parameters.txt > +++ security-testing-2.6/Documentation/kernel-parameters.txt > @@ -44,6 +44,7 @@ parameter is applicable: > FB The frame buffer device is enabled. > HW Appropriate hardware is enabled. > IA-64 IA-64 architecture is enabled. > + IMA Integrity measurement architecture is enabled. > INTEGRITY Integrity support is enabled. > IOSCHED More than one I/O scheduler is enabled. > IP_PNP IP DHCP, BOOTP, or RARP is enabled. > @@ -862,6 +863,10 @@ and is between 256 and 4096 characters. > ihash_entries= [KNL] > Set number of hash buckets for inode cache. > > + ima_hash= [IMA] runtime ability to define hash crypto alg.
Please spell out algorithm.
> + Format: { "MD5" | "SHA1" } > + Default is "SHA1". > + > in2000= [HW,SCSI] > See header of drivers/scsi/in2000.c. > > Index: security-testing-2.6/security/integrity/ima/Kconfig > =================================================================== > --- /dev/null > +++ security-testing-2.6/security/integrity/ima/Kconfig > @@ -0,0 +1,48 @@ > +# > +# IBM Integrity Measurement Architecture > +# > + > +config IMA > + bool "Integrity Measurement Architecture(IMA)" > + depends on INTEGRITY > + depends on ACPI > + select CRYPTO > + select CRYPTO_HMAC > + select CRYPTO_MD5 > + select CRYPTO_SHA1 > + select TCG_TPM > + select TCG_TIS > + help > + The Trusted Computing Group(TCG) runtime Integrity > + Measurement Architecture(IMA) maintains a list of hash > + values of executables and other sensitive system files > + loaded into the run-time of this system. If your system > + has a TPM chip, then IMA also maintains an aggregate > + integrity value over this list inside the TPM hardware. > + These measurements and the aggregate (signed inside the > + TPM) can be retrieved and presented to remote parties to > + establish system properties. If unsure, say N. > + > +config IMA_MEASURE_PCR_IDX > + int "PCR for Aggregate (8<= Index <= 14)"
Use consistent spacing (8 <= Index <= 14).
> + depends on IMA > + range 8 14 > + default 10 > + help > + IMA_MEASURE_PCR_IDX determines the TPM PCR register index > + that IMA uses to maintain the integrity aggregate of the > + measurement list. If unsure, use the default 10. > + > +config IMA_BASE_HOOKS > + bool "IMA base hooks" > + depends on IMA > + default n > + help > + Enable this option to allow the LSM module to enforce integrity. > + > +config IMA_LSM_RULES > + bool "Enable LSM measurement policy rules" > + depends on IMA && (SELINUX || SMACK) > + default y > + help > + Disabling this option will not enforce LSM based policy rules.
--- ~Randy Linux Plumbers Conference, 17-19 September 2008, Portland, Oregon USA http://linuxplumbersconf.org/
| |