Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <d3f6dad3-3f0a-481d-3067-36c0a4ea279f@linux.ibm.com>
Date:   Fri, 29 Apr 2022 13:42:55 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.7.0
Subject: Re: [PATCH v8 7/7] fsverity: update the documentation
Content-Language: en-US
To:     Mimi Zohar <zohar@linux.ibm.com>, linux-integrity@vger.kernel.org
Cc:     Eric Biggers <ebiggers@kernel.org>, linux-fscrypt@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20220429112601.1421947-1-zohar@linux.ibm.com>
 <20220429112601.1421947-8-zohar@linux.ibm.com>
From:   Stefan Berger <stefanb@linux.ibm.com>
In-Reply-To: <20220429112601.1421947-8-zohar@linux.ibm.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 4/29/22 07:26, Mimi Zohar wrote:
> Update the fsverity documentation related to IMA signature support.
> 
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
>   Documentation/filesystems/fsverity.rst | 35 +++++++++++++++++---------
>   1 file changed, 23 insertions(+), 12 deletions(-)
> 
> diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
> index 8cc536d08f51..b7d42fd65e9d 100644
> --- a/Documentation/filesystems/fsverity.rst
> +++ b/Documentation/filesystems/fsverity.rst
> @@ -70,12 +70,23 @@ must live on a read-write filesystem because they are independently
>   updated and potentially user-installed, so dm-verity cannot be used.
>   
>   The base fs-verity feature is a hashing mechanism only; actually
> -authenticating the files is up to userspace.  However, to meet some
> -users' needs, fs-verity optionally supports a simple signature
> -verification mechanism where users can configure the kernel to require
> -that all fs-verity files be signed by a key loaded into a keyring; see
> -`Built-in signature verification`_.  Support for fs-verity file hashes
> -in IMA (Integrity Measurement Architecture) policies is also planned.
> +authenticating the files may be done by:
> +
> +* Userspace-only
> +
> +* Builtin signature verification + userspace policy
> +
> +  fs-verity optionally supports a simple signature verification
> +  mechanism where users can configure the kernel to require that
> +  all fs-verity files be signed by a key loaded into a keyring;
> +  see `Built-in signature verification`_.
> +
> +* Integrity Measurement Architecture (IMA)
> +
> +  IMA supports including fs-verity file digests and signatures in the
> +  IMA measurement list and verifying fs-verity based file signatures
> +  stored as security.ima xattrs, based on policy.
> +
>   
>   User API
>   ========
> @@ -653,12 +664,12 @@ weren't already directly answered in other parts of this document.
>       hashed and what to do with those hashes, such as log them,
>       authenticate them, or add them to a measurement list.
>   
> -    IMA is planned to support the fs-verity hashing mechanism as an
> -    alternative to doing full file hashes, for people who want the
> -    performance and security benefits of the Merkle tree based hash.
> -    But it doesn't make sense to force all uses of fs-verity to be
> -    through IMA.  As a standalone filesystem feature, fs-verity
> -    already meets many users' needs, and it's testable like other
> +    IMA supports the fs-verity hashing mechanism as an alternative
> +    to full file hashes, for those who want the performance and
> +    security benefits of the Merkle tree based hash.  However, it
> +    doesn't make sense to force all uses of fs-verity to be through
> +    IMA.  fs-verity already meets many users' needs even as a
> +    standalone filesystem feature, and it's testable like other
>       filesystem features e.g. with xfstests.
>   
>   :Q: Isn't fs-verity useless because the attacker can just modify the

Acked-by: Stefan Berger <stefanb@linux.ibm.com>