On Thu, 2020-08-13 at 10:21 -0400, Chuck Lever wrote:

quoted

On Aug 12, 2020, at 11:42 AM, James Bottomley <James.Bottomley@Hans
enPartnership.com> wrote:

[...]

quoted

For most people the security mechanism of local xattrs is
sufficient.  If you're paranoid, you don't believe it is and you
use EVM.

When IMA metadata happens to be stored in local filesystems in
a trusted xattr, it's going to enjoy the protection you describe
without needing the addition of a cryptographic signature.

However, that metadata doesn't live its whole life there. It
can reside in a tar file, it can cross a network, it can live
on a back-up tape. I think we agree that any time that metadata
is in transit or at rest outside of a Linux local filesystem, it
is exposed.

Thus I'm interested in a metadata protection mechanism that does
not rely on the security characteristics of a particular storage
container. For me, a cryptographic signature fits that bill
nicely.

Sure, but one of the points about IMA is a separation of mechanism from
policy.  Signed hashes (called appraisal in IMA terms) is just one
policy you can decide to require or not or even make it conditional on
other things.

quoted

quoted

quoted

I think Mimi's other point is actually that IMA uses a flat
hash which we derive by reading the entire file and then
watching for mutations. Since you cannot guarantee we get
notice of mutation with NFS, the entire IMA mechanism can't
really be applied in its current form and we have to resort to
chunk at a time verifications that a Merkel tree would provide.

I'm not sure what you mean by this. An NFS client relies on
notification of mutation to maintain the integrity of its cache
of NFS file content, and it's done that since the 1980s.

Mutation detection is part of the current IMA security model.  If
IMA sees a file mutate it has to be rehashed the next time it
passes the gate.  If we can't trust the NFS server, we can't trust
the NFS mutation notification and we have to have a different
mechanism to check the file.

When an NFS server lies about mtime and ctime, then NFS is completely
broken. Untrusted NFS server doesn't mean "broken behavior" -- I
would think that local filesystems will have the same problem if
they can't trust a local block device to store filesystem metadata
like indirect blocks and timestamps.

It's not clear to me that IMA as currently implemented can protect
against broken storage devices or incorrect filesystem behavior.

IMA doesn't really care about the storage.  The gate check will fail if
the storage corrupts the file because the hashes won't match.  The
mechanism for modification notification is the province of the
filesystem and there are definitely some which don't do it (or other fs
features) correctly and thus can't use IMA.

quoted

quoted

In addition to examining a file's mtime and ctime as maintained
by the NFS server, a client can rely on the file's NFSv4 change
attribute or an NFSv4 delegation.

And that's secure in the face of a malicious or compromised server?

The bottom line is still, I think we can't use linear hashes with
an open/exec/mmap gate with NFS and we have to move to chunk at a
time verification like that provided by a merkel tree.

That's fine until we claim that remote filesystems require one form
of metadata and local filesystems use some other form.

To guarantee an unbroken chain of provenance, everyone has to use the
same portable metadata format that is signed once by the content
creator. That's essentially why I believe the Merkle-based metadata
format must require that the tree root is signed.

Well, no, that would be optional policy.  We should certainly support
signed head hashes and require it if the policy said so, but we
shouldn't enforce it without the policy.

Suppose I'm a cloud service provider exporting files over NFS on the
control (private) network.  I use IMA to measure untrusted tenants to
get a feel for what they're doing, but since I control the NFS server,
the client and the private network, I wouldn't feel the requirement to
have signed hashes because I trust other mechanisms for the security.

James