From: Roberto Sassu <roberto.sassu@xxxxxxxxxx> One of the IMA shortcomings over the years has been the availability of reference digest values for appraisal. Recently, the situation improved and some Linux distributions are including file signatures. The digest_cache LSM takes a different approach. Instead of requiring Linux distributions to include file signatures in their packages, it parses the digests from signed RPM package headers and exposes an API for integrity providers to query a digest. That enables Linux distributions to immediately gain the ability to do integrity checks with the existing packages, lowering the burden for software vendors. In addition, integrating IMA with the digest_cache LSMs has even more benefits. First, it allows generating a new-style masurement list including the RPM package headers and the unknown files, which improves system performance due to the lower usage of the TPM. The cost is the less accuracy of the information reported, which might not suitable for everyone. Second, performance improve for appraisal too. It has been found that verifying the signatures of only the RPM package headers and doing a digest lookup is much less computationally expensive than verifying individual file signatures. For reference, a preliminary performance evaluation has been published here: https://lore.kernel.org/linux-integrity/20240415142436.2545003-15-roberto.sassu@xxxxxxxxxxxxxxx/ Third, it makes a PCR predictable and suitable for TPM key sealing policies. Finally, it allows IMA to maintain a predictable PCR and to perform appraisal from the very beginning of the boot, in the initial ram disk (of course, it won't recognize automatically generated files, that don't exist in the RPM packages). Integration of IMA with the digest_cache LSM is straightforward. Patch 1 lets IMA know when the digest_cache LSM is reading a digest list, to populate a digest cache. Patch 2 allows nested IMA verification of digest lists read by the digest_cache LSM. Patch 3 allows the usage of digest caches with the IMA policy. Patch 4 introduces new boot-time built-in policies, to use digest caches from the very beginning (it allows measurement/appraisal from the initial ram disk). Patch 5 modifies existing boot-time built-in policies if the digest_cache LSM-specific policies have been selected at boot. Patch 6 attaches the verification result of the digest list to the digest cache being populated with that digest list. Patch 7-8 enable the usage of digest caches respectively for measurement and appraisal, at the condition that it is authorized with the IMA policy and that the digest list itself was measured and appraised too. Patch 9 subscribes to digest cache events and invalidates cached integrity results on digest cache reset (file or directory modification). Open points: - Mimi prefers to extend flags in ima_iint_cache, rather than passing the parameter down to process_measurement() - will do in a next version - Prefetching of digest lists should not be done if there is no measurement rule (not relevant for appraisal) Changelog v1: - Change digest_cache= policy keyword value from 'content' to 'data' (suggested by Mimi) - Move digest_cache LSM integration code to ima_digest_cache.c (suggested by Mimi) - Don't store digest cache pointer in integrity metadata - Rename 'digest_cache_mask' parameter of ima_get_action() and ima_match_policy() to 'digest_cache_usage' - Rename 'digest_cache_mask' parameter of ima_store_measurement() and ima_appraise_measurement() to 'allowed_usage' - Try digest cache method as first in ima_appraise_measurement() (suggested by Mimi) - Introduce ima_digest_cache_change() to be called on digest cache reset - Subscribe to digest cache events - Add forgotten modification in ima_iint_lockdep_annotate() (reported by Mimi) - Replace 'digest_cache_mask' member of the ima_rule_entry structure with 'digest_cache_usage' (suggested by Mimi) - Split patch introducing digest_cache LSM-specific boot-time built-in policies and modifying existing rules - Add digest_cache LSM-specific boot-time built-in policies if the digest_cache LSM is enabled in the kernel configuration - Rename IMA_DIGEST_CACHE_MEASURE_CONTENT and IMA_DIGEST_CACHE_APPRAISE_CONTENT to IMA_DIGEST_CACHE_MEASURE_DATA and IMA_DIGEST_CACHE_APPRAISE_DATA Roberto Sassu (9): ima: Introduce hook DIGEST_LIST_CHECK ima: Nest iint mutex for DIGEST_LIST_CHECK hook ima: Add digest_cache policy keyword ima: Add digest_cache_measure/appraise boot-time built-in policies ima: Modify existing boot-time built-in policies with digest cache policies ima: Store allowed usage in digest cache based on integrity metadata flags ima: Use digest caches for measurement ima: Use digest caches for appraisal ima: Register to the digest_cache LSM notifier and process events Documentation/ABI/testing/ima_policy | 6 +- .../admin-guide/kernel-parameters.txt | 15 ++- security/integrity/ima/Kconfig | 10 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 22 +++- security/integrity/ima/ima_api.c | 21 ++- security/integrity/ima/ima_appraise.c | 32 +++-- security/integrity/ima/ima_digest_cache.c | 123 ++++++++++++++++++ security/integrity/ima/ima_digest_cache.h | 36 +++++ security/integrity/ima/ima_iint.c | 17 ++- security/integrity/ima/ima_main.c | 46 +++++-- security/integrity/ima/ima_policy.c | 122 ++++++++++++++++- 12 files changed, 413 insertions(+), 38 deletions(-) create mode 100644 security/integrity/ima/ima_digest_cache.c create mode 100644 security/integrity/ima/ima_digest_cache.h -- 2.34.1
