[PATCH v3 0/4] unverifiable file signatures
Eric W. Biederman
ebiederm at xmission.com
Tue Mar 13 19:40:18 UTC 2018
Mimi Zohar <zohar at linux.vnet.ibm.com> writes:
> For local filesystems, the kernel prevents files being executed from
> being modified. With IMA-measurement enabled, the kernel also emits
> audit "time of measure, time of use" messages for files opened for
> read, and subsequently opened for write.
> Files on fuse are initially measured, appraised, and audited. Although
> the file data can change dynamically any time, making re-measuring,
> re-appraising, or re-auditing pointless, this patch set attempts to
> differentiate between unprivileged non-init root and privileged
> mounted fuse filesystems.
Acked-by: "Eric W. Biederman" <ebiederm at xmission.com>
Overall ack on the way this is put together.
> This patch set addresses three different scenarios:
> - Unprivileged non-init root mounted fuse filesystems are untrusted.
> Signature verification should always fail and re-measuring,
> re-appraising, re-auditing files makes no sense.
> Always enabled.
> - For privileged mounted filesystems in a "secure" environment, with a
> correctly enforced security policy, which is willing to assume the
> inherent risk of specific fuse filesystems, it is reasonable to
> re-measure, re-appraise, and re-audit files.
> Enabled by default to prevent breaking existing systems.
> - Privileged mounted filesystems unwilling to assume the risks and
> prefers to securely fail safe.
> Enabled based on policy.
> Changelog v3:
> - Fix SB_IMA_UNVERIFIABLE_SIGNATURE & SB_I_UNTRUSTED_MOUNTER test.
> - Rename the builtin policy name to "fail_securely".
> Mimi Zohar (4):
> ima: fail file signature verification on non-init mounted filesystems
> ima: re-evaluate files on privileged mounted filesystems
> ima: fail signature verification based on policy
> fuse: define the filesystem as untrusted
> Documentation/admin-guide/kernel-parameters.txt | 8 +++++++-
> fs/fuse/inode.c | 3 +++
> include/linux/fs.h | 2 ++
> security/integrity/ima/ima_appraise.c | 16 +++++++++++++++-
> security/integrity/ima/ima_main.c | 14 ++++++++++++--
> security/integrity/ima/ima_policy.c | 5 +++++
> security/integrity/integrity.h | 1 +
> 7 files changed, 45 insertions(+), 4 deletions(-)
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
More information about the Linux-security-module-archive