Only after an IMA policy is loaded, check, save, or update the cached
file's integrity status.
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/ima/ima_main.c | 6 ++++++
1 file changed, 6 insertions(+)
From: Petr Vorel <pvorel@suse.cz> Date: 2022-02-24 14:20:35
Hi Mimi, Tetsuo, Kees, all,
FYI this commit merged as 92063f3ca73a ("integrity: double check iint_cache was initialized")
is the reason for openSUSE distro installer going back from lsm= to deprecated
security= when filling default grub parameters because security=apparmor or
security=selinux does not break boot when used with ima_policy=tcb, unlike
using lsm.
@Kees, @Mimi sure, people who use ima_policy=tcb will just remove lsm parameter
or add "integrity" to it but I wonder whether there could be "integrity"
automatic inclusion when using ima_policy=tcb. Although the point of lsm= (and
CONFIG_LSM) is to have *ordered* list of enabled LSMs and it wouldn't be clear
on which place.
Kind regards,
Petr
Hi Mimi, Tetsuo, Kees, all,
FYI this commit merged as 92063f3ca73a ("integrity: double check iint_cache was initialized")
is the reason for openSUSE distro installer going back from lsm= to deprecated
security= when filling default grub parameters because security=apparmor or
security=selinux does not break boot when used with ima_policy=tcb, unlike
using lsm.
OK, color me confused. Integrity isn't an LSM. It doesn't
call security_add_hooks().
@Kees, @Mimi sure, people who use ima_policy=tcb will just remove lsm parameter
or add "integrity" to it but I wonder whether there could be "integrity"
automatic inclusion when using ima_policy=tcb. Although the point of lsm= (and
CONFIG_LSM) is to have *ordered* list of enabled LSMs and it wouldn't be clear
on which place.
Why would adding integrity to the lsm= make sense? It's not an LSM.
Sorry, but something is wrong here.
From: Petr Vorel <pvorel@suse.cz> Date: 2022-02-24 17:42:42
Hi Casey,
On 2/24/2022 6:20 AM, Petr Vorel wrote:
quoted
Hi Mimi, Tetsuo, Kees, all,
quoted
FYI this commit merged as 92063f3ca73a ("integrity: double check iint_cache was initialized")
is the reason for openSUSE distro installer going back from lsm= to deprecated
security= when filling default grub parameters because security=apparmor or
security=selinux does not break boot when used with ima_policy=tcb, unlike
using lsm.
OK, color me confused. Integrity isn't an LSM. It doesn't
call security_add_hooks().
Really: "Initially I also questioned making "integrity" an LSM. Perhaps it's
time to reconsider." [1]
quoted
@Kees, @Mimi sure, people who use ima_policy=tcb will just remove lsm parameter
or add "integrity" to it but I wonder whether there could be "integrity"
automatic inclusion when using ima_policy=tcb. Although the point of lsm= (and
CONFIG_LSM) is to have *ordered* list of enabled LSMs and it wouldn't be clear
on which place.
Why would adding integrity to the lsm= make sense? It's not an LSM.
Hi Mimi, Tetsuo, Kees, all,
FYI this commit merged as 92063f3ca73a ("integrity: double check iint_cache was initialized")
is the reason for openSUSE distro installer going back from lsm= to deprecated
security= when filling default grub parameters because security=apparmor or
security=selinux does not break boot when used with ima_policy=tcb, unlike
using lsm.
OK, color me confused. Integrity isn't an LSM. It doesn't
call security_add_hooks().
Really: "Initially I also questioned making "integrity" an LSM. Perhaps it's
time to reconsider." [1]
It was always my expectation, which appears to have been poorly
communicated, that "making integrity an LSM" meant using the LSM
hook infrastructure. Just adding "integrity" to lsm= doesn't make
it an LSM to my mind.
quoted
quoted
@Kees, @Mimi sure, people who use ima_policy=tcb will just remove lsm parameter
or add "integrity" to it but I wonder whether there could be "integrity"
automatic inclusion when using ima_policy=tcb. Although the point of lsm= (and
CONFIG_LSM) is to have *ordered* list of enabled LSMs and it wouldn't be clear
on which place.
Why would adding integrity to the lsm= make sense? It's not an LSM.
Sorry, but something is wrong here.
np. I explained that: try to boot with "ima_policy=tcb lsm=" or "ima_policy=tcb
lsm=whatever" (whatever != integrity).
Also have look at commit 92063f3ca73a ("integrity: double check iint_cache was
initialized") which explain why it's needed.
"The mixed metaphor never boils."
What is bothering me is that IMA, which is not an LSM, depends on the
LSM mechanism for specification. Sigh, I can see that boat has sailed.
Since IMA doesn't use the LSM hook mechanisms (doesn't add hooks to the
hook lists) it shouldn't matter where in the lsm= string "integrity" is
or where in CONFIG_LSM it appears. The ordering is only relevant to the
"registered" hooks, and IMA doesn't register.
... except that it shouldn't be 1st, since "capability" is always supposed
to be 1st. And it shouldn't be last, because BPF whats to be there, and I
can't say if their user-space will handle the lsm string if it isn't.
Hi Petr, Casey,
On Thu, 2022-02-24 at 10:51 -0800, Casey Schaufler wrote:
On 2/24/2022 9:42 AM, Petr Vorel wrote:
It was always my expectation, which appears to have been poorly
communicated, that "making integrity an LSM" meant using the LSM
hook infrastructure. Just adding "integrity" to lsm= doesn't make
it an LSM to my mind.
Agreed. The actual commit that introduced the change was 3d6e5f6dcf65
("LSM: Convert security_initcall() into DEFINE_LSM()").
--
thanks,
Mimi
From: Petr Vorel <pvorel@suse.cz> Date: 2022-02-28 13:44:39
Hi Mimi, all,
Hi Petr, Casey,
On Thu, 2022-02-24 at 10:51 -0800, Casey Schaufler wrote:
quoted
On 2/24/2022 9:42 AM, Petr Vorel wrote:
quoted
It was always my expectation, which appears to have been poorly
communicated, that "making integrity an LSM" meant using the LSM
hook infrastructure. Just adding "integrity" to lsm= doesn't make
it an LSM to my mind.
Agreed. The actual commit that introduced the change was 3d6e5f6dcf65
("LSM: Convert security_initcall() into DEFINE_LSM()").
I wonder whether we can improve things now.
Kind regards,
Petr
On Mon, 2022-02-28 at 14:44 +0100, Petr Vorel wrote:
Hi Mimi, all,
quoted
Hi Petr, Casey,
quoted
On Thu, 2022-02-24 at 10:51 -0800, Casey Schaufler wrote:
quoted
On 2/24/2022 9:42 AM, Petr Vorel wrote:
quoted
quoted
It was always my expectation, which appears to have been poorly
communicated, that "making integrity an LSM" meant using the LSM
hook infrastructure. Just adding "integrity" to lsm= doesn't make
it an LSM to my mind.
quoted
Agreed. The actual commit that introduced the change was 3d6e5f6dcf65
("LSM: Convert security_initcall() into DEFINE_LSM()").
I wonder whether we can improve things now.
I'm not sure it is possible to revert the change. Perhaps the simplest
solution would be to move integrity off the security hook. It just
needs to be initialized before EVM and IMA.
thanks,
Mimi