Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: Selinux policy for x509_ima.der public certificate loaded by
 kernel during boot
To:     rishi gupta <gupt21@gmail.com>
Cc:     linux-integrity <linux-integrity@vger.kernel.org>,
        selinux-refpolicy@vger.kernel.org, selinux@vger.kernel.org
References: <CALUj-gt8KD4Cc-zgvXP-8vNdR3RB_Sdx7yd2cv7GX_wBCM6gEQ@mail.gmail.com>
 <28afd683-8423-0331-4b7d-ec71d46be30c@rosalinux.ru>
 <CALUj-gtyVJ9nLYWYbX2Oa9=dcCYqc2H0RkO4HQcJKj2ejAfSYg@mail.gmail.com>
From:   Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Message-ID: <bdd1becf-c72d-876a-cd9b-cef7b6fe55e9@rosalinux.ru>
Date:   Sat, 7 Nov 2020 01:15:54 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <CALUj-gtyVJ9nLYWYbX2Oa9=dcCYqc2H0RkO4HQcJKj2ejAfSYg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: ru-RU
Content-Transfer-Encoding: quoted-printable
Precedence: bulk


06.11.2020 18:50, rishi gupta =D0=BF=D0=B8=D1=88=D0=B5=D1=82:
> On Fri, Nov 6, 2020 at 8:42 PM Mikhail Novosyolov
> <m.novosyolov@rosalinux.ru> wrote:
>> 06.11.2020 15:22, rishi gupta =D0=BF=D0=B8=D1=88=D0=B5=D1=82:
>>> I am getting below error as selinux is denying access to the .ima
>>> keyring. Looking for guidance for asymmetric public key selinux
>>> policy.
>>>
>>> [  172.014855] integrity: Request for unknown key 'id:87deb3bf' err -=
13
>> I am getting the same error without selinux.
> If I make selinux permissive, it works for me. So I know in my case
> the problem is selinux.
>>> [  172.015035] audit: type=3D1800 audit(1604596570.579:240): pid=3D82=
5
>>> uid=3D1021 auid=3D4294967295 ses=3D4294967295
>>> subj=3Dsystem_u:system_r:mydaemon_t:s0-s15:c0.c1023 op=3D"appraise_da=
ta"
>>> cause=3D"invalid-signature" comm=3D"mydaemon"
>>> name=3D"/usr/lib/libstdc++.so.6.0.25" dev=3D"ubifs" ino=3D14353 res=3D=
0
>> Selinux context is just logged here. It has nothing to do with reasons=
 of ivalid signature. Public key seems to be not loaded.
> Basically when we access a file, driver checks if selinux allow access
> to it or not. In my case this function is returning -EACCES
> https://github.com/torvalds/linux/blob/master/security/keys/permission.=
c#L88
>>> (a) Do I need to set the selinux context of file
>>> /etc/keys/x509_ima.der. If yes what it should be.
>>> (b) Do I need to set some selinux rule for .ima keyring. If yes how. =
I
>>> tried a lot but could not find any resource.
>> Usually IMA policy is loaded before SELinux policy I think
> I am using the policy defined in ima_policy driver as of now. My kernel=
 is 4.14.
What is "ima_policy driver"? How does selinux and IMA policies get loaded=
 on your system?
>>> Regards,
>>> Rishi