[RFC] IMA: New IMA measurements for dm-crypt and selinux
tusharsu at linux.microsoft.com
Fri Apr 17 00:49:44 UTC 2020
On 2020-04-08 9:34 a.m., Casey Schaufler wrote:
> On 4/8/2020 3:19 AM, Tushar Sugandhi wrote:
>> B. Measuring selinux constructs:
>> We propose to add an IMA hook in enforcing_set() present under
>> enforcing_set() sets the selinux state to enforcing/permissive etc.
>> and is called from key places like selinux_init(),
>> sel_write_enforce() etc.
>> The hook will measure various attributes related to selinux status.
>> Majority of the attributes are present in the struct selinux_state
>> present in security/selinux/include/security.h
>> SELinux status: enabled
>> SELinuxfs mount: /sys/fs/selinux
>> SELinux root directory: /etc/selinux
>> Loaded policy name: default
>> Current mode: permissive
>> Mode from config file: permissive
>> Policy MLS status: enabled
>> Policy deny_unknown status: allowed
>> Memory protection checking: requested (insecure)
>> Max kernel policy version: 32
>> The above attributes will be serialized into a set of key=value
>> pairs when passed to IMA for measurement.
>> Proposed Function Signature of the IMA hook:
>> void ima_selinux_status(void *selinux_status, int len);
>> Please provide comments\feedback on the proposal.
> TL;DR - Why make this SELinux specific?
> Integrating IMA and SELinux is a layering violation at best.
> Why isn't this ima_lsm_status(void *lsm_status, int len)?
That seems like a good idea.
I will investigate where can I place the hook for LSM.
Please let me know if you have any recommendations.
> Or, better yet, how about ima_lsm_status(char *name, void *value, int len),
> and you pass each name/value pair separately? That makes the
> interface generally useful.
> Believe it or not, there *ARE* security modules that
> are not SELinux.
>>  https://sourceforge.net/p/linux-ima/wiki/Home/
>>  https://selinuxproject.org/page/FAQ
>>  https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt
More information about the Linux-security-module-archive