Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752767AbdHIJQn (ORCPT ); Wed, 9 Aug 2017 05:16:43 -0400 Received: from lhrrgout.huawei.com ([194.213.3.17]:32816 "EHLO lhrrgout.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752360AbdHIJQl (ORCPT ); Wed, 9 Aug 2017 05:16:41 -0400 Subject: Re: [Linux-ima-devel] [PATCH, RESEND 08/12] ima: added parser for RPM data type To: James Morris References: <20170725154423.24845-9-roberto.sassu@huawei.com> <20170801102036.15371-1-roberto.sassu@huawei.com> <20170801102709.GA24285@infradead.org> <11206fd8-d189-deb0-ab67-aec373f8d979@huawei.com> CC: Christoph Hellwig , , , , , , From: Roberto Sassu Message-ID: <0506050f-c4f1-1b36-a25b-c5418607906d@huawei.com> Date: Wed, 9 Aug 2017 11:15:32 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [10.220.133.130] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020201.598AD2D1.00E4,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: f62e3d61963557de265216e284989b51 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3236 Lines: 74 On 8/2/2017 9:22 AM, James Morris wrote: > On Tue, 1 Aug 2017, Roberto Sassu wrote: > >> On 8/1/2017 12:27 PM, Christoph Hellwig wrote: >>> On Tue, Aug 01, 2017 at 12:20:36PM +0200, Roberto Sassu wrote: >>>> This patch introduces a parser for RPM packages. It extracts the digests >>>> from the RPMTAG_FILEDIGESTS header section and converts them to binary >>>> data >>>> before adding them to the hash table. >>>> >>>> The advantage of this data type is that verifiers can determine who >>>> produced that data, as headers are signed by Linux distributions vendors. >>>> RPM headers signatures can be provided as digest list metadata. >>> >>> Err, parsing arbitrary file formats has no business in the kernel. >> >> The benefit of this choice is that no actions are required for >> Linux distribution vendors to support the solution I'm proposing, >> because they already provide signed digest lists (RPM headers). >> >> Since the proof of loading a digest list is the digest of the >> digest list (included in the list metadata), if RPM headers are >> converted to a different format, remote attestation verifiers >> cannot check the signature. >> >> If the concern is security, it would be possible to prevent unsigned >> RPM headers from being parsed, if the PGP key type is upstreamed >> (adding in CC keyrings@vger.kernel.org). > > It's a security concern and also a layering violation, there should be no > need to parse package file formats in the kernel. Parsing RPMs is not strictly necessary. Digests from the headers can be extracted and written to a new file using the compact data format (introduced with patch 7/12). At boot time, IMA measures this file before digests are uploaded to the kernel. At this point, only files with unknown digest will be added to the measurement list. At verification time, verifiers recreate the measurement list by merging together the digests uploaded to the kernel with the unknown digests. Then, they verify the obtained list. There are two ways to verify the digests: searching them in a reference database, or checking a signature. With the 'ima-sig' measurement list template, it is possible to verify signatures for each accessed file. With this patch set, it is possible to verify the signature of the file containing the digests uploaded to the kernel. If the data format changes, the signature cannot be verified. To avoid this limitation, the parsers could be moved to a userspace tool which then uploads the parsed digests to the kernel. IMA would measure the original files. But, if the tool is compromised, it could load digests not included in the parsed files. With the current solution this problem does not arise because no changes can be done by userspace applications to the uploaded data while digests are parsed by IMA. I could remove the RPM parser from the patch set for now. Is the remaining part of the patch set ok, and is the explanation of what it does clear? Thanks Roberto > I'm not really clear on exactly how this patch series works. Can you > provide a more concrete explanation of what steps would occur during boot > and attestation? > -- HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Bo PENG, Qiuen PENG, Shengli WANG