Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <0694c3637dddaaddb6a2a5b679c58448746bc70d.camel@linux.ibm.com>
Subject: Re: Selinux policy for x509_ima.der public certificate loaded by
 kernel during boot
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     rishi gupta <gupt21@gmail.com>,
        Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Cc:     linux-integrity <linux-integrity@vger.kernel.org>,
        selinux-refpolicy@vger.kernel.org, selinux@vger.kernel.org
Date:   Tue, 10 Nov 2020 15:45:38 -0500
In-Reply-To: <CALUj-gtQsSnU0Yq5Syc7aOkN0PH_MHvziuuG1-9zotVUAJ2QoQ@mail.gmail.com>
References: <CALUj-gt8KD4Cc-zgvXP-8vNdR3RB_Sdx7yd2cv7GX_wBCM6gEQ@mail.gmail.com>
         <28afd683-8423-0331-4b7d-ec71d46be30c@rosalinux.ru>
         <CALUj-gtyVJ9nLYWYbX2Oa9=dcCYqc2H0RkO4HQcJKj2ejAfSYg@mail.gmail.com>
         <bdd1becf-c72d-876a-cd9b-cef7b6fe55e9@rosalinux.ru>
         <CALUj-gtQsSnU0Yq5Syc7aOkN0PH_MHvziuuG1-9zotVUAJ2QoQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

On Mon, 2020-11-09 at 21:14 +0530, rishi gupta wrote:
> On Sat, Nov 7, 2020 at 3:45 AM Mikhail Novosyolov
> <m.novosyolov@rosalinux.ru> wrote:
> >
> >
> > 06.11.2020 18:50, rishi gupta пишет:
> > > On Fri, Nov 6, 2020 at 8:42 PM Mikhail Novosyolov
> > > <m.novosyolov@rosalinux.ru> wrote:
> > >> 06.11.2020 15:22, rishi gupta пишет:
> > >>> I am getting below error as selinux is denying access to the .ima
> > >>> keyring. Looking for guidance for asymmetric public key selinux
> > >>> policy.
> > >>>
> > >>> [  172.014855] integrity: Request for unknown key 'id:87deb3bf' err -13
> > >> I am getting the same error without selinux.
> > > If I make selinux permissive, it works for me. So I know in my case
> > > the problem is selinux.
> > >>> [  172.015035] audit: type=1800 audit(1604596570.579:240): pid=825
> > >>> uid=1021 auid=4294967295 ses=4294967295
> > >>> subj=system_u:system_r:mydaemon_t:s0-s15:c0.c1023 op="appraise_data"
> > >>> cause="invalid-signature" comm="mydaemon"
> > >>> name="/usr/lib/libstdc++.so.6.0.25" dev="ubifs" ino=14353 res=0
> > >> Selinux context is just logged here. It has nothing to do with reasons of ivalid signature. Public key seems to be not loaded.
> > > Basically when we access a file, driver checks if selinux allow access
> > > to it or not. In my case this function is returning -EACCES
> > > https://github.com/torvalds/linux/blob/master/security/keys/permission.c#L88
> > >>> (a) Do I need to set the selinux context of file
> > >>> /etc/keys/x509_ima.der. If yes what it should be.
> > >>> (b) Do I need to set some selinux rule for .ima keyring. If yes how. I
> > >>> tried a lot but could not find any resource.
> > >> Usually IMA policy is loaded before SELinux policy I think
> > > I am using the policy defined in ima_policy driver as of now. My kernel is 4.14.
> > What is "ima_policy driver"? How does selinux and IMA policies get loaded on your system?
> 
> For test purpose I am using "ima_policy=tcb ima_appraise_tcb" in the
> commandline.
> I have not changed anything in the policy defined in 4.14 kernel driver for now.
> https://github.com/torvalds/linux/blob/bebc6082da0a9f5d47a1ea2edc099bf671058bd4/security/integrity/ima/ima_policy.c#L132
> https://github.com/torvalds/linux/blob/bebc6082da0a9f5d47a1ea2edc099bf671058bd4/security/integrity/ima/ima_policy.c#L88

Is root able to verify a file signature signed with this key? 
Afterwards are you able to verify this file's signature?

Mimi