Update the fsverity documentation related to IMA signature support.
Signed-off-by: Mimi Zohar <[email protected]>
---
Documentation/filesystems/fsverity.rst | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
index 1d831e3cbcb3..c71f6e365df5 100644
--- a/Documentation/filesystems/fsverity.rst
+++ b/Documentation/filesystems/fsverity.rst
@@ -74,8 +74,12 @@ authenticating the files is up to userspace. However, to meet some
users' needs, fs-verity optionally supports a simple signature
verification mechanism where users can configure the kernel to require
that all fs-verity files be signed by a key loaded into a keyring; see
-`Built-in signature verification`_. Support for fs-verity file hashes
-in IMA (Integrity Measurement Architecture) policies is also planned.
+`Built-in signature verification`_.
+
+IMA (Integrity Measurement Architecture) supports fs-verity file
+digests based signatures stored as security.ima xattrs, which are
+identified by the signature type IMA_VERITY_DIGSIG.
+
User API
========
@@ -653,13 +657,13 @@ weren't already directly answered in other parts of this document.
hashed and what to do with those hashes, such as log them,
authenticate them, or add them to a measurement list.
- IMA is planned to support the fs-verity hashing mechanism as an
- alternative to doing full file hashes, for people who want the
- performance and security benefits of the Merkle tree based hash.
- But it doesn't make sense to force all uses of fs-verity to be
- through IMA. As a standalone filesystem feature, fs-verity
- already meets many users' needs, and it's testable like other
- filesystem features e.g. with xfstests.
+ IMA supports the fs-verity hashing mechanism as an alternative
+ to doing full file hashes, for people who want the performance
+ and security benefits of the Merkle tree based hash. But it
+ doesn't make sense to force all uses of fs-verity to be through
+ IMA. As a standalone filesystem feature, fs-verity already meets
+ many users' needs, and it's testable like other filesystem
+ features e.g. with xfstests.
:Q: Isn't fs-verity useless because the attacker can just modify the
hashes in the Merkle tree, which is stored on-disk?
--
2.27.0
On Thu, Dec 02, 2021 at 04:55:07PM -0500, Mimi Zohar wrote:
> Update the fsverity documentation related to IMA signature support.
>
> Signed-off-by: Mimi Zohar <[email protected]>
> ---
> Documentation/filesystems/fsverity.rst | 22 +++++++++++++---------
> 1 file changed, 13 insertions(+), 9 deletions(-)
>
> diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
> index 1d831e3cbcb3..c71f6e365df5 100644
> --- a/Documentation/filesystems/fsverity.rst
> +++ b/Documentation/filesystems/fsverity.rst
> @@ -74,8 +74,12 @@ authenticating the files is up to userspace. However, to meet some
> users' needs, fs-verity optionally supports a simple signature
> verification mechanism where users can configure the kernel to require
> that all fs-verity files be signed by a key loaded into a keyring; see
> -`Built-in signature verification`_. Support for fs-verity file hashes
> -in IMA (Integrity Measurement Architecture) policies is also planned.
> +`Built-in signature verification`_.
> +
> +IMA (Integrity Measurement Architecture) supports fs-verity file
> +digests based signatures stored as security.ima xattrs, which are
> +identified by the signature type IMA_VERITY_DIGSIG.
> +
>
> User API
> ========
> @@ -653,13 +657,13 @@ weren't already directly answered in other parts of this document.
> hashed and what to do with those hashes, such as log them,
> authenticate them, or add them to a measurement list.
>
> - IMA is planned to support the fs-verity hashing mechanism as an
> - alternative to doing full file hashes, for people who want the
> - performance and security benefits of the Merkle tree based hash.
> - But it doesn't make sense to force all uses of fs-verity to be
> - through IMA. As a standalone filesystem feature, fs-verity
> - already meets many users' needs, and it's testable like other
> - filesystem features e.g. with xfstests.
> + IMA supports the fs-verity hashing mechanism as an alternative
> + to doing full file hashes, for people who want the performance
> + and security benefits of the Merkle tree based hash. But it
> + doesn't make sense to force all uses of fs-verity to be through
> + IMA. As a standalone filesystem feature, fs-verity already meets
> + many users' needs, and it's testable like other filesystem
> + features e.g. with xfstests.
>
Isn't there IMA documentation that can be linked to?
- Eric