Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752051AbdFOH5K convert rfc822-to-8bit (ORCPT ); Thu, 15 Jun 2017 03:57:10 -0400 Received: from mo1501.tsb.2iij.net ([210.149.48.173]:36541 "EHLO mo.tsb.2iij.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750830AbdFOH5J (ORCPT ); Thu, 15 Jun 2017 03:57:09 -0400 X-MXL-Hash: 59423dc55237f50e-0b38d6975b49e668ffa09b0447cda0cc8ed8e868 From: To: , CC: , , , , Subject: RE: [RFC 0/3] WhiteEgret LSM module Thread-Topic: [RFC 0/3] WhiteEgret LSM module Thread-Index: AQHS2YZOYQc5NfPQyEem2JpSl+uOwqINr+eAgABNdACAF6VjgA== Date: Thu, 15 Jun 2017 07:56:50 +0000 Message-ID: References: <20170530111157.5196-1-masanobu2.koike@toshiba.co.jp> <20170530205002.GA9841@srcf.ucam.org> <88D2080F-FEFA-4535-ACF1-01A584F469D9@linux.vnet.ibm.com> In-Reply-To: <88D2080F-FEFA-4535-ACF1-01A584F469D9@linux.vnet.ibm.com> Accept-Language: ja-JP, en-US Content-Language: ja-JP x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [133.196.14.204] msscp.transfermailtomossagent: 103 Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 X-MAIL-FROM: X-SOURCE-IP: [172.27.153.184] X-Spam: exempt Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3245 Lines: 81 Hi Mehmet, Thank you for your suggestion to use IMA appraisal. I'm sorry for the delay in replying to you. I'm studying IMA appraisal. There is something I don't understand yet. Could you please teach me the following items? We assume that "fixing" has already finished and that IMA appraisal is running in "enforce" mode. - I have a question for a procedure of labeling and appraising a new or updated executable file. Suppose that we want to create a new executable file (included in policy) and make it be measured and appraised. Then what kind of procedure should I do? Similarly, how do I update appraised file to be continuously permitted to execute? - When we copy (cp command with -a option) or move an appraised executable file to somewhere, is the copied or moved executable file permitted to execute as well? - (related to the above question) What kind of data is hashed to security.ima? Thanks in advance, Masanobu Koike > -----Original Message----- > > > On May 31, 2017, at 6:59 AM, Peter Dolding wrote: > > > > Number 1 we need to split the idea of signed and whitelisted. IMA is > > signed should not be confused with white-listed. You will find > > policies stating whitelist and signed as two different things. > > IMA-appraisal can do both. If the securtiy.ima extended attribute > of the file is a hash and not a signature, then it is whitelisting. > > > Like you see here in Australian government policy there is another > > thing called whitelisted. > > > https://www.asd.gov.au/publications/protect/top_4_mitigations_linux.ht > m > > Matthew Garrett you might want to call IMA whitelisting Australian > > government for one does not agree. IMA is signed. The difference > > between signed and white-listed is you might have signed a lot more > > than what a particular system is white-listed to allowed used. > > I doubt the Australian government is an authority on Linux features. > IMA-appraisal can be set to "fix" mode with a boot parameter. If the > policy covers what you want to whitelist (e.g. files opened by user x), > and then when those files are accessed, the kernel writes out the hash. > Then, you can switch to "enforce" mode to allow only files with hashes. > > Also, you can achieve the same thing by signing all whitelisted > files and add the certificate to .ima keyring and throwing away the > signing key. > > > The feature need to include in it name whitelisting or just like the > > Australian Department of Defence other parties will mark Linux has not > > having this feature. > > I guess we need to advertise IMA-appraisal better. > > > Whitelist is program name/path and checksum/s. If the file any more > > than that is now not a Whitelist but a Security Policy Enforcement or > > signing. Whitelist and blacklists are meant to be simple things. > > This is also why IMA fails and is signed to too complete to be a basic > > Whitelist. > > When you work out all the little details, you arrive at IMA-appraisal. > You have to consider how the scheme is bootstrapped and how it > is protected against the root. IMA-appraisal either relies on a boot > parameter and write-once policy, or the trusted keyrings. > > > Peter Dolding. > > Mehmet >