Messages in this thread | | | Subject | Re: [RFC][PATCH 4/8] ima: Add digest_cache_measure and digest_cache_appraise boot-time policies | From | Mimi Zohar <> | Date | Mon, 11 Mar 2024 09:01:03 -0400 |
| |
On Wed, 2024-02-14 at 15:35 +0100, Roberto Sassu wrote: > From: Roberto Sassu <roberto.sassu@huawei.com> > > Specify the 'digest_cache_measure' boot-time policy with 'ima_policy=' in > the kernel command line to add the following rule at the beginning of the > IMA policy, before other rules: > > measure func=DIGEST_LIST_CHECK pcr=12 > > which will measure digest lists into PCR 12 (or the value in > CONFIG_IMA_DIGEST_CACHE_MEASURE_PCR_IDX). > > 'digest_cache_measure' also adds 'digest_cache=content pcr=12' to the other > measure rules, if they have a compatible IMA hook. The PCR value still > comes from CONFIG_IMA_DIGEST_CACHE_MEASURE_PCR_IDX. > > Specify 'digest_cache_appraise' to add the following rule at the beginning, > before other rules: > > appraise func=DIGEST_LIST_CHECK appraise_type=imasig|modsig > > which will appraise digest lists with IMA signatures or module-style > appended signatures. > > 'digest_cache_appraise' also adds 'digest_cache=content' to the other > appraise rules, if they have a compatible IMA hook.
Defining two new built-in policies - digest_cache_measure, digest_cache_appraise - in a single patch would be acceptable, if there wasn't anything else going on.
Changing other policy rules should not be made in this patch. A clear explanation as to why other policy rules need to be modified is needed. It shouldn't be hidden here.
thanks,
Mimi
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> >
| |