On 12/25/15 at 09:45am, Mimi Zohar wrote:
> On Fri, 2015-12-25 at 13:33 +0800, Dave Young wrote:
> > Hi, Mimi
> > CCing kexec list, not all kexec people subscribed to IMA list.
> > I just subscribed to it since Vivek CCed me last time about the V1 of this
> > series.
> > On 12/23/15 at 06:55pm, Mimi Zohar wrote:
> > > This patch defines a new IMA hook ima_hash_and_process_file() for
> > > measuring and appraising files read by the kernel. The caller loads
> > > the file into memory before calling this function, which calculates
> > > the hash followed by the normal IMA policy based processing.
> > >
> > > Two new IMA policy functions named KEXEC_CHECK and INITRAMFS_CHECK
> > > are defined for measuring, appraising or auditing the kexec image
> > > and initramfs.
> > Could you help us understand why do we need it first.
> IMA can be viewed as extending secure and trusted boot to the running
> system in a uniform and consistent manner. As files are accessed,
> based on policy, IMA measures them, appends the file measurements to the
> running measurement list (<securityfs>/ima/ascii_runtime_measurements)
> and appraises the file's integrity, based on either the file's hash or
> signature, which are stored as extended attributes in "security.ima".
> There are still a couple of file measurement and appraisal gaps that
> need to be closed.
> > I think I do not really understand the purpose of the IMA handling
> > about kexec kernel and initramfs.
> One of those measurement and appraisal gaps are files that are read by
> the kernel, like the kexec image and initramfs.
> [There is a lot of code duplication in the kernel for reading a file and
> verifying its signature. Each place does it just a bit differently
> than the other. I'm working with Luis Rodriguez on defining a single,
> common function - https://lkml.org/lkml/2015/12/21/478.]
> > * Does the files in disk space have already contains some hash values
> > and when kernel load it IMA functions will do some checking? But seems I do
> > not
> > see such handling..
> IMA sits on a number of the LSM hooks, where they exist, and in other
> places defines its own hook. This patch set defines a new IMA hook for
> measuring and appraising files being read by the kernel.
> > * Does it try to calculate the hash of the file buffer after copying,
> IMA calculates the file hash, in this case, based on the buffer
> contents. The hash is calculated once and used for both measurement
> and appraisal. If the file integrity appraisal fails (eg. hash
> comparison or signature failure), IMA prevents the kexec files from
> being used.
Ok, thanks for the explanatioin. But I have another question, why do we
need a special hook for KEXEC? Shouldn't all files use same way to do the
measurement and appraisal?
To unsubscribe from this list: send the line "unsubscribe
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html