On 2020-04-08 9:34 a.m., Casey Schaufler wrote:
On 4/8/2020 3:19 AM, Tushar Sugandhi wrote:
<snip>
B. Measuring selinux constructs:
We propose to add an IMA hook in enforcing_set() present under
security/selinux/include/security.h.
enforcing_set() sets the selinux state to enforcing/permissive etc.
and is called from key places like selinux_init(),
sel_write_enforce() etc.
The hook will measure various attributes related to selinux status.
Majority of the attributes are present in the struct selinux_state
present in security/selinux/include/security.h
e.g.
$sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: permissive
Mode from config file: permissive
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: requested (insecure)
Max kernel policy version: 32
The above attributes will be serialized into a set of key=value
pairs when passed to IMA for measurement.
Proposed Function Signature of the IMA hook:
void ima_selinux_status(void *selinux_status, int len);
Please provide comments\feedback on the proposal.
TL;DR - Why make this SELinux specific?
Integrating IMA and SELinux is a layering violation at best.
Why isn't this ima_lsm_status(void *lsm_status, int len)?
That seems like a good idea.
I will investigate where can I place the hook for LSM.
Please let me know if you have any recommendations.
Or, better yet, how about ima_lsm_status(char *name, void *value, int len),
and you pass each name/value pair separately? That makes the
interface generally useful.
Believe it or not, there *ARE* security modules that
are not SELinux.
Thanks,
Tushar
[1] https://sourceforge.net/p/linux-ima/wiki/Home/
[2] https://selinuxproject.org/page/FAQ
[3] https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt
--
dm-devel mailing list
dm-devel@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/dm-devel
