[PATCH v3 0/4] unverifiable file signatures

[Eric W. Biederman]

Mimi Zohar <zohar at linux.vnet.ibm.com> writes:

> For local filesystems, the kernel prevents files being executed from
> being modified.  With IMA-measurement enabled, the kernel also emits
> audit "time of measure, time of use" messages for files opened for
> read, and subsequently opened for write.
>
> Files on fuse are initially measured, appraised, and audited.  Although
> the file data can change dynamically any time, making re-measuring,
> re-appraising, or re-auditing pointless, this patch set attempts to
> differentiate between unprivileged non-init root and privileged
> mounted fuse filesystems.

Acked-by: "Eric W. Biederman" <ebiederm at xmission.com>

Overall ack on the way this is put together.

Eric

> This patch set addresses three different scenarios:
> - Unprivileged non-init root mounted fuse filesystems are untrusted.
>   Signature verification should always fail and re-measuring,
>   re-appraising, re-auditing files makes no sense.
>
>   Always enabled.
>
> - For privileged mounted filesystems in a "secure" environment, with a
>   correctly enforced security policy, which is willing to assume the
>   inherent risk of specific fuse filesystems, it is reasonable to
>   re-measure, re-appraise, and re-audit files.
>
>   Enabled by default to prevent breaking existing systems.
>
> - Privileged mounted filesystems unwilling to assume the risks and
>   prefers to securely fail safe.
>
>   Enabled based on policy.
>
> Changelog v3:
> - Fix SB_IMA_UNVERIFIABLE_SIGNATURE & SB_I_UNTRUSTED_MOUNTER test.
> - Rename the builtin policy name to "fail_securely".
>
> Mimi
>
> Mimi Zohar (4):
>   ima: fail file signature verification on non-init mounted filesystems
>   ima: re-evaluate files on privileged mounted filesystems
>   ima: fail signature verification based on policy
>   fuse: define the filesystem as untrusted
>
>  Documentation/admin-guide/kernel-parameters.txt |  8 +++++++-
>  fs/fuse/inode.c                                 |  3 +++
>  include/linux/fs.h                              |  2 ++
>  security/integrity/ima/ima_appraise.c           | 16 +++++++++++++++-
>  security/integrity/ima/ima_main.c               | 14 ++++++++++++--
>  security/integrity/ima/ima_policy.c             |  5 +++++
>  security/integrity/integrity.h                  |  1 +
>  7 files changed, 45 insertions(+), 4 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html