Received: by 2002:a05:6a10:16a7:0:0:0:0 with SMTP id gp39csp1605421pxb; Fri, 6 Nov 2020 14:17:23 -0800 (PST) X-Google-Smtp-Source: ABdhPJwwKCBU+av55EDfXo8s6gYwh+k2NQ3frUCnB3R/yj13tWGKx6pN2CO+d9pmfPC/ay9uGE1J X-Received: by 2002:a17:906:57cc:: with SMTP id u12mr4294400ejr.163.1604701043313; Fri, 06 Nov 2020 14:17:23 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1604701043; cv=none; d=google.com; s=arc-20160816; b=gNDTf9Mn2VzyQ3jM16qcKB2ZDQgdwwW+S/aQCbtoF3rsHnsmPsTtmxkcZ2A8OKWd9B tEVihDty/Qylp7eklMw8y3NaSr1jOwW94lwh9eZMCOQomrlzv5B7B/oA1PxYwfcA703g rZe2dPaMSDbBoZ1/rrThwHoN8qQNq/h1haXMY3dffI78Y1J6wdPK+rzHxdOIpt+hAURl EZ4Lnw1LkBr5OTkc5NPBHjGmW3/hXucQbfYZd84NILLJn7MR0O9qx3Ka4WpwIdVM50zL thgN+Efr+PoI63/xpdqG/YA9Xp+Qr/q+eB6wdhMquCGMsSptaHOkJ1IDm6P9OmrHBjaG SBTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:content-language :in-reply-to:mime-version:user-agent:date:message-id:from:references :cc:to:subject:dkim-signature:dkim-filter; bh=Ue6ZRRrBPjLGXdUu0xLub/SlWb78cpWnaDjMIMfLwtY=; b=DFYao6js/tIHS5s10M8YZRc+9gWNghSyIJoT7Y2CfiTnwFdPOTzVDputdl5xuZCe6R UXxo3Ifp38EsfDLXQy+P7hubNvIcSeuoyD6kI/EwqOkAWdZXGpWbtAfzreobQFE7qT/d zxzv+Tha3AfmvepniDhA7ZfSQoereH9fO/uZN/klkjuvVvJWRveUgJirrANy+U+5w+6U ZuSivE4RSGRXkWWorlALqX4u+3POdyNv5TjycDTFQkE59J1YOxGCenAw+4ifcgXZ1yt9 WBc8gFvZpeyGdJ/YwLcu0a6Y7v5ryQArzpwf5EPvZ/kM7eHFKm6gSip/z7BbcYbHwzCw 7WKg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@rosalinux.ru header.s=A1AAD92A-9767-11E6-A27F-AC75C9F78EF4 header.b=epSn7RlO; spf=pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=rosalinux.ru Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id hs35si1857290ejc.312.2020.11.06.14.17.17; Fri, 06 Nov 2020 14:17:23 -0800 (PST) Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@rosalinux.ru header.s=A1AAD92A-9767-11E6-A27F-AC75C9F78EF4 header.b=epSn7RlO; spf=pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=rosalinux.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728564AbgKFWQA (ORCPT + 17 others); Fri, 6 Nov 2020 17:16:00 -0500 Received: from mail.rosalinux.ru ([195.19.76.54]:35534 "EHLO mail.rosalinux.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728131AbgKFWP7 (ORCPT ); Fri, 6 Nov 2020 17:15:59 -0500 Received: from localhost (localhost [127.0.0.1]) by mail.rosalinux.ru (Postfix) with ESMTP id CE212DB8EE21B; Sat, 7 Nov 2020 01:15:55 +0300 (MSK) Received: from mail.rosalinux.ru ([127.0.0.1]) by localhost (mail.rosalinux.ru [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id hopWbOV1vp0F; Sat, 7 Nov 2020 01:15:55 +0300 (MSK) Received: from localhost (localhost [127.0.0.1]) by mail.rosalinux.ru (Postfix) with ESMTP id 39947DB8EE204; Sat, 7 Nov 2020 01:15:55 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.10.3 mail.rosalinux.ru 39947DB8EE204 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rosalinux.ru; s=A1AAD92A-9767-11E6-A27F-AC75C9F78EF4; t=1604700955; bh=Ue6ZRRrBPjLGXdUu0xLub/SlWb78cpWnaDjMIMfLwtY=; h=To:From:Message-ID:Date:MIME-Version; b=epSn7RlOjWUtFh7BHOK1XvN0CObN775w+8XVtsGUayqKCgKwhZRthfZKOGGSbF3S/ IAgkLGfnDSZrqK6AZGsKQFBMDcoYtLyWEQOyeB7ff1K/kK9um3C5M6pA2bxTa3XZQu /0LCBQHDJ0Z5UXIudPIVMbGuZmcMMVcJw3fSweCkTXFznw4neYgsQ5Xj+B1QEB5aMl 7y83QiolwCudSIkFBKL+7YQD/AFKngOm6oxnJ1BDZQkEirTu1kx5PVYpD+How10b4M Bq77WCz9PumvMTzB/EtdKJREXjJm1slBjSmiYTN2fj86aAwS4/Sqxc5rwwrKPzNeDv TIbzG5r6Wzpfg== X-Virus-Scanned: amavisd-new at rosalinux.ru Received: from mail.rosalinux.ru ([127.0.0.1]) by localhost (mail.rosalinux.ru [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id IvHGINrad3MD; Sat, 7 Nov 2020 01:15:55 +0300 (MSK) Received: from [192.168.1.173] (broadband-90-154-71-72.ip.moscow.rt.ru [90.154.71.72]) by mail.rosalinux.ru (Postfix) with ESMTPSA id C71ACDB8D6477; Sat, 7 Nov 2020 01:15:54 +0300 (MSK) Subject: Re: Selinux policy for x509_ima.der public certificate loaded by kernel during boot To: rishi gupta Cc: linux-integrity , selinux-refpolicy@vger.kernel.org, selinux@vger.kernel.org References: <28afd683-8423-0331-4b7d-ec71d46be30c@rosalinux.ru> From: Mikhail Novosyolov Message-ID: Date: Sat, 7 Nov 2020 01:15:54 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: ru-RU Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org 06.11.2020 18:50, rishi gupta =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > On Fri, Nov 6, 2020 at 8:42 PM Mikhail Novosyolov > wrote: >> 06.11.2020 15:22, rishi gupta =D0=BF=D0=B8=D1=88=D0=B5=D1=82: >>> I am getting below error as selinux is denying access to the .ima >>> keyring. Looking for guidance for asymmetric public key selinux >>> policy. >>> >>> [ 172.014855] integrity: Request for unknown key 'id:87deb3bf' err -= 13 >> I am getting the same error without selinux. > If I make selinux permissive, it works for me. So I know in my case > the problem is selinux. >>> [ 172.015035] audit: type=3D1800 audit(1604596570.579:240): pid=3D82= 5 >>> uid=3D1021 auid=3D4294967295 ses=3D4294967295 >>> subj=3Dsystem_u:system_r:mydaemon_t:s0-s15:c0.c1023 op=3D"appraise_da= ta" >>> cause=3D"invalid-signature" comm=3D"mydaemon" >>> name=3D"/usr/lib/libstdc++.so.6.0.25" dev=3D"ubifs" ino=3D14353 res=3D= 0 >> Selinux context is just logged here. It has nothing to do with reasons= of ivalid signature. Public key seems to be not loaded. > Basically when we access a file, driver checks if selinux allow access > to it or not. In my case this function is returning -EACCES > https://github.com/torvalds/linux/blob/master/security/keys/permission.= c#L88 >>> (a) Do I need to set the selinux context of file >>> /etc/keys/x509_ima.der. If yes what it should be. >>> (b) Do I need to set some selinux rule for .ima keyring. If yes how. = I >>> tried a lot but could not find any resource. >> Usually IMA policy is loaded before SELinux policy I think > I am using the policy defined in ima_policy driver as of now. My kernel= is 4.14. What is "ima_policy driver"? How does selinux and IMA policies get loaded= on your system? >>> Regards, >>> Rishi