Messages in this thread | | | Subject | Re: [PATCH 2/2] ima: Support appraise_type=imasig_optional | From | Mimi Zohar <> | Date | Thu, 14 Feb 2013 10:48:48 -0500 |
| |
On Thu, 2013-02-14 at 09:40 -0500, Vivek Goyal wrote: > On Wed, Feb 13, 2013 at 04:45:23PM -0500, Mimi Zohar wrote: > [..]
> > > If it would happen that it contains signature, then IMA_DIGSIG flag > > > would be set, > > > and process could get needed capability as Vivek wants. > > > > With the 'optional' condition, both unsigned and validly signed files > > will succeed. One way of making this information accessible to an LSM, > > would be to define a new integrity capability and set it here. The new > > integrity capability would indicate the file was validly signed. > > Thinking loud. > > The problem with integrity capability is that it goes only so far. If > we provide capability in exec() path, then that capability means much > more in the sense, we know file is locked to run from memory. An integrity > capability just means file is validly signed.
> So exec() code might have to do another capability on top which will > also ensure that file is executable is locked in memory and signature > verification is done after loading in memory so that it is not open > to writing to disk block attacks. > > And based on this capability we probably need to deny write access to file > till file is open for exec() (I noticed that after load, we seem to be > allowing access to write access).
I think we're back to my original comment that the bprm_check hook might need to be moved or an additional hook added, as the existing bprm_check hook is located before the file is locked from modification. :)
thanks,
Mimi
| |