09 Nov, 2011

1 commit

• 8607c5014   integrity: digital signature verification using multiple keyrings ... Browse Code »

  Define separate keyrings for each of the different use cases - evm, ima,
  and modules. Using different keyrings improves search performance, and also
  allows "locking" specific keyring to prevent adding new keys.
  This is useful for evm and module keyrings, when keys are usually only
  added from initramfs.

  Signed-off-by: Dmitry Kasatkin

  Dmitry Kasatkin

  2011-11-09 22:51:09 +0800  

19 Jul, 2011

2 commits

• 66dbc325a   evm: re-release ... Browse Code »

  EVM protects a file's security extended attributes(xattrs) against integrity
  attacks. This patchset provides the framework and an initial method. The
  initial method maintains an HMAC-sha1 value across the security extended
  attributes, storing the HMAC value as the extended attribute 'security.evm'.
  Other methods of validating the integrity of a file's metadata will be posted
  separately (eg. EVM-digital-signatures).

  While this patchset does authenticate the security xattrs, and
  cryptographically binds them to the inode, coming extensions will bind other
  directory and inode metadata for more complete protection. To help simplify
  the review and upstreaming process, each extension will be posted separately
  (eg. IMA-appraisal, IMA-appraisal-directory). For a general overview of the
  proposed Linux integrity subsystem, refer to Dave Safford's whitepaper:
  http://downloads.sf.net/project/linux-ima/linux-ima/Integrity_overview.pdf.

  EVM depends on the Kernel Key Retention System to provide it with a
  trusted/encrypted key for the HMAC-sha1 operation. The key is loaded onto the
  root's keyring using keyctl. Until EVM receives notification that the key has
  been successfully loaded onto the keyring (echo 1 > /evm), EVM can
  not create or validate the 'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
  Loading the key and signaling EVM should be done as early as possible. Normally
  this is done in the initramfs, which has already been measured as part of the
  trusted boot. For more information on creating and loading existing
  trusted/encrypted keys, refer to Documentation/keys-trusted-encrypted.txt. A
  sample dracut patch, which loads the trusted/encrypted key and enables EVM, is
  available from http://linux-ima.sourceforge.net/#EVM.

  Based on the LSMs enabled, the set of EVM protected security xattrs is defined
  at compile. EVM adds the following three calls to the existing security hooks:
  evm_inode_setxattr(), evm_inode_post_setxattr(), and evm_inode_removexattr. To
  initialize and update the 'security.evm' extended attribute, EVM defines three
  calls: evm_inode_post_init(), evm_inode_post_setattr() and
  evm_inode_post_removexattr() hooks. To verify the integrity of a security
  xattr, EVM exports evm_verifyxattr().

  Changelog v7:
  - Fixed URL in EVM ABI documentation

  Changelog v6: (based on Serge Hallyn's review)
  - fix URL in patch description
  - remove evm_hmac_size definition
  - use SHA1_DIGEST_SIZE (removed both MAX_DIGEST_SIZE and evm_hmac_size)
  - moved linux include before other includes
  - test for crypto_hash_setkey failure
  - fail earlier for invalid key
  - clear entire encrypted key, even on failure
  - check xattr name length before comparing xattr names

  Changelog:
  - locking based on i_mutex, remove evm_mutex
  - using trusted/encrypted keys for storing the EVM key used in the HMAC-sha1
  operation.
  - replaced crypto hash with shash (Dmitry Kasatkin)
  - support for additional methods of verifying the security xattrs
  (Dmitry Kasatkin)
  - iint not allocated for all regular files, but only for those appraised
  - Use cap_sys_admin in lieu of cap_mac_admin
  - Use __vfs_setxattr_noperm(), without permission checks, from EVM

  Signed-off-by: Mimi Zohar
  Acked-by: Serge Hallyn

  Mimi Zohar

  2011-07-19 00:29:40 +0800  
• f381c2722   integrity: move ima inode integrity data management ... Browse Code »

  Move the inode integrity data(iint) management up to the integrity directory
  in order to share the iint among the different integrity models.

  Changelog:
  - don't define MAX_DIGEST_SIZE
  - rename several globally visible 'ima_' prefixed functions, structs,
  locks, etc to 'integrity_'
  - replace '20' with SHA1_DIGEST_SIZE
  - reflect location change in appropriate Kconfig and Makefiles
  - remove unnecessary initialization of iint_initialized to 0
  - rebased on current ima_iint.c
  - define integrity_iint_store/lock as static

  There should be no other functional changes.

  Signed-off-by: Mimi Zohar
  Acked-by: Serge Hallyn

  Mimi Zohar

  2011-07-19 00:29:38 +0800