From patchwork Thu Jun 6 11:26:18 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 10979341 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4393A92A for ; Thu, 6 Jun 2019 11:29:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2D25B288C3 for ; Thu, 6 Jun 2019 11:29:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1AA95288E4; Thu, 6 Jun 2019 11:29:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9B9DE288C3 for ; Thu, 6 Jun 2019 11:29:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727082AbfFFL3f (ORCPT ); Thu, 6 Jun 2019 07:29:35 -0400 Received: from lhrrgout.huawei.com ([185.176.76.210]:32987 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727034AbfFFL3f (ORCPT ); Thu, 6 Jun 2019 07:29:35 -0400 Received: from lhreml705-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id BDD6AA80612E5B3DBD10; Thu, 6 Jun 2019 12:29:32 +0100 (IST) Received: from roberto-HP-EliteDesk-800-G2-DM-65W.huawei.com (10.204.65.154) by smtpsuk.huawei.com (10.201.108.46) with Microsoft SMTP Server (TLS) id 14.3.408.0; Thu, 6 Jun 2019 12:29:23 +0100 From: Roberto Sassu To: , , CC: , , , , , , Roberto Sassu Subject: [PATCH v3 0/2] ima/evm fixes for v5.2 Date: Thu, 6 Jun 2019 13:26:18 +0200 Message-ID: <20190606112620.26488-1-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.204.65.154] X-CFilter-Loop: Reflected Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Previous versions included the patch 'ima: don't ignore INTEGRITY_UNKNOWN EVM status'. However, I realized that this patch cannot be accepted alone because IMA-Appraisal would deny access to new files created during the boot. With the current behavior, those files are accessible because they have a valid security.ima (not protected by EVM) created after the first write. A solution for this problem is to initialize EVM very early with a random key. Access to created files will be granted, even with the strict appraisal, because after the first write those files will have both security.ima and security.evm (HMAC calculated with the random key). Strict appraisal will work only if it is done with signatures until the persistent HMAC key is loaded. Roberto Sassu (2): evm: add option to set a random HMAC key at early boot ima: add enforce-evm and log-evm modes to strictly check EVM status .../admin-guide/kernel-parameters.txt | 11 ++-- security/integrity/evm/evm.h | 10 +++- security/integrity/evm/evm_crypto.c | 57 ++++++++++++++++--- security/integrity/evm/evm_main.c | 41 ++++++++++--- security/integrity/ima/ima_appraise.c | 8 +++ security/integrity/integrity.h | 1 + 6 files changed, 106 insertions(+), 22 deletions(-)