Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <d82ad1cac36e948c904300548c64244c145589ee.camel@linux.ibm.com>
Subject: Re: [PATCH v6 0/8] IMA: support for measuring kernel integrity
 critical data
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Pavel Machek <pavel@ucw.cz>,
        Tushar Sugandhi <tusharsu@linux.microsoft.com>
Cc:     stephen.smalley.work@gmail.com, casey@schaufler-ca.com,
        agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com,
        paul@paul-moore.com, tyhicks@linux.microsoft.com,
        sashal@kernel.org, jmorris@namei.org, nramas@linux.microsoft.com,
        linux-integrity@vger.kernel.org, selinux@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        linux-kernel@vger.kernel.org, dm-devel@redhat.com
Date:   Mon, 23 Nov 2020 08:41:35 -0500
In-Reply-To: <20201122210031.GA26756@amd>
References: <20201119232611.30114-1-tusharsu@linux.microsoft.com>
         <20201120124657.GA31468@duo.ucw.cz>
         <aadf6e35-39bc-74d4-6ca3-d708860738a5@linux.microsoft.com>
         <20201122210031.GA26756@amd>
Content-Type: text/plain; charset="ISO-8859-15"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi Pavel,

On Sun, 2020-11-22 at 22:00 +0100, Pavel Machek wrote:
> Hi!
> 
> > >How is it supposed to be useful?
> > >
> > >I'm pretty sure there are critical data that are not measured by
> > >proposed module... and that are written under normal circumstances.
> > >
> > The goal of this series is to introduce the IMA hook
> > measure_critical_data() and the necessary policies to use it; and
> > illustrate that use with one example (SELinux). It is not scalable to
> > identify and update all the critical data sources to use the proposed
> > module at once.
> > 
> > A piecemeal approach to add more critical data measurement in subsequent
> > patches would be easy to implement and review.
> 
> Basically every other data structure in kernel is "critical" by your
> definition, and you can't really measure them all; some of them change
> rather often. Going piecemeal does not really help here.

Agreed, measuring data structures that change is not really applicable.
However, measuring data structures that once initialized don't change,
does make sense (similar concept to __ro_after_init).  The attestation
server doesn't need to know anything about the measurement, other than
more than a single measurement is indicative of a problem.

Mimi

> Example of critical data structure: page table entries for process I
> own.