| Message ID | 20240130214620.3155380-1-stefanb@linux.ibm.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | evm: Support signatures on stacked filesystem | expand |
On Tue, Jan 30, 2024 at 11:46 PM Stefan Berger <stefanb@linux.ibm.com> wrote: > > EVM has recently been completely disabled on unsupported (e.g., > overlayfs). This series now enables copy-up of "portable and immutable" > signatures on those filesystems and enables the enforcement of > "portable and immutable" as well as the "original" signatures on > previously unsupported filesystem when EVM is enabled with EVM_INIT_X509. > HMAC verification and generation remains disabled on those filesystems. > I am missing a high level description of what is in those "portable and immutable" signatures and how those signatures remain valid across copy up. Thanks, Amir.
On 1/31/24 08:18, Amir Goldstein wrote: > On Tue, Jan 30, 2024 at 11:46 PM Stefan Berger <stefanb@linux.ibm.com> wrote: >> >> EVM has recently been completely disabled on unsupported (e.g., >> overlayfs). This series now enables copy-up of "portable and immutable" >> signatures on those filesystems and enables the enforcement of >> "portable and immutable" as well as the "original" signatures on >> previously unsupported filesystem when EVM is enabled with EVM_INIT_X509. >> HMAC verification and generation remains disabled on those filesystems. >> > > I am missing a high level description of what is in those "portable > and immutable" > signatures and how those signatures remain valid across copy up. > From 2/5: "Portable and immutable EVM signatures can be copied up by stacked file- system since the metadata their signature covers does not include file- system-specific data such as a file's inode number, generation, and UUID." Instead, the signatures cover file metadata such as file mode bits, uid, and gid as well as xattrs, which can all be preserved unchanged across a copy-up. Reference: https://elixir.bootlin.com/linux/v6.7.2/source/security/integrity/evm/evm_crypto.c#L169 > Thanks, > Amir. >
EVM has recently been completely disabled on unsupported (e.g., overlayfs). This series now enables copy-up of "portable and immutable" signatures on those filesystems and enables the enforcement of "portable and immutable" as well as the "original" signatures on previously unsupported filesystem when EVM is enabled with EVM_INIT_X509. HMAC verification and generation remains disabled on those filesystems. Regards, Stefan Stefan Berger (5): security: allow finer granularity in permitting copy-up of security xattrs evm: Implement per signature type decision in security_inode_copy_up_xattr ima: Reset EVM status upon detecting changes to overlay backing file evm: Use the real inode's metadata to calculate metadata hash evm: Enforce signatures on unsupported filesystem for EVM_INIT_X509 fs/overlayfs/copy_up.c | 2 +- include/linux/evm.h | 10 +++++- include/linux/lsm_hook_defs.h | 3 +- include/linux/security.h | 4 +-- security/integrity/evm/evm_crypto.c | 2 +- security/integrity/evm/evm_main.c | 48 +++++++++++++++++++++++------ security/integrity/ima/ima_main.c | 2 ++ security/security.c | 7 +++-- security/selinux/hooks.c | 2 +- security/smack/smack_lsm.c | 2 +- 10 files changed, 62 insertions(+), 20 deletions(-)