[PATCH] security: Fix IMA Kconfig for dependencies on ARM64

On Thu, 2018-03-15 at 12:19 -0400, Mimi Zohar wrote:

On Wed, 2018-03-14 at 10:25 -0700, James Bottomley wrote:

quoted

On Wed, 2018-03-14 at 13:08 -0400, Mimi Zohar wrote:

[..]

quoted

quoted

Adding additional support for post IMA-initialization for TPM's
built as kernel modules is clearly not optimal for all of the
reasons provided to now and will be confusing, but could be
supported. ?This delayed loading of the TPM needs to be clearly
indicated in both the audit log and in IMA's measurement list.

Why if the measurement chain isn't broken? ?The way I'm thinking of
implementing it, IMA wouldn't even know.

I'm not sure this is good news.

quoted

What would happen is that a NULL tpm chip in
tpm_pcr_read/tpm_pcr_extend would trigger the usual
search for the first TPM but if none were found and we'd booted on
an EFI system, we'd just use the EFI driver to do perform the
operation.

If EFI is extending the TPM, will the events be added to the TPM
event log or to the IMA measurement list?

I'm not proposing any changes to the tpm_pcr_extend API. ?At the moment
it does an extend without logging, so that's what it will do in the EFI
driver case as well. ?That means logging is still the responsibility of
the caller.

 ? Up to now the IMA boot aggregate record includes PCRs from 0 - 7.
?With these PCRs, the boot aggregate wouldn't change when booting the
same kernel. ?Would you change the boot-aggregate to include these
other PCRs?

This is all IMA internal stuff that's up to you. ?All I would do is
make the tpm_pcr API work with an EFI driver. ?That has no impact on
what the PCRs return (well, unless we start using it to log early
components of the kernel boot, which is a possibility).

quoted

There's probably a bit of additional subtlety making the kernel and
EFI agree which TPM they're using in a multi-TPM situation.

Agreed

quoted

The EFI driver isn't full featured: it only does measurement and
logging, but it looks like that's all IMA needs.

What happens for non EFI systems, when you can't extend the TPM?

The same as happens today if there's no TPM available: you'd get an
error return. ?Since older bios is essentially legacy, I wouldn't
propose fixing this, but the TCG does define a non-EFI BIOS interface
which could theoretically be used in the same way as the BIOS one if
someone with a legacy box were interested in implementing it.

James

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html