[RFC] IMA Log Snapshotting Design Proposal

[James Bottomley]

On Mon, 2023-08-07 at 18:49 -0400, Stefan Berger wrote:
> 
> 
> On 8/1/23 17:21, James Bottomley wrote:
> > On Tue, 2023-08-01 at 12:12 -0700, Sush Shringarputale wrote:
> > [...]
> > > Truncating IMA log to reclaim memory is not feasible, since it
> > > makes the log go out of sync with the TPM PCR quote making remote
> > > attestation fail.
> > 
> > This assumption isn't entirely true.  It's perfectly possible to
> > shard an IMA log using two TPM2_Quote's for the beginning and end
> > PCR values to validate the shard.  The IMA log could be truncated
> > in the same way (replace the removed part of the log with a
> > TPM2_Quote and AK, so the log still validates from the beginning
> > quote to the end).
> > 
> > If you use a TPM2_Quote mechanism to save the log, all you need to
> > do is have the kernel generate the quote with an internal AK.  You
> > can keep a record of the quote and the AK at the beginning of the
> > truncated kernel log.  If the truncated entries are saved in a file
> > shard it
> 
> The truncation seems dangerous to me. Maybe not all the scenarios
> with an attestation client (client = reading logs and quoting) are
> possible then anymore, such as starting an attestation client only
> after truncation but a verifier must have witnessed the system's PCRs
> and log state before the truncation occurred.

That's not exactly correct.  Nothing needs to have "witnessed" the
starting PCR value because the quote vouches for it (and can vouch for
it after the fact).  The only thing you need to verify the quote is the
attestation key and the only thing you need to do to trust the
attestation key is ensure it was TPM created.  All of that can be
verified after the fact as well.  The only thing that can be done to
disrupt this is to destroy the TPM (or re-own it).

Remember the assumption is you *also* have the removed log shard to
present.  From that the PCR state of the starting quote can be
calculated and checked for matching the quote.  If you lose that, it's
equivalent to the log being tampered with and all bets are off.  The
assumption is that because of the impossibility of engineering TPM
extensions, it should be impossible to come up with a fake log that
produces the PCRs of the real one.  If that's violated, then IMA itself
becomes useless.

James