Hello
I am trying to make IMA work properly and have faced a strange issue which I cannot explain.
What I want to do is load IMA policy from /etc/sysconfig/ima-policy in initrd (it is loaded OK) and then load a self-created public key, I created a pair of keys (using LibreSSL, patch for ima-evm-utils is ready, but I need to make everyting work), and I configured the kernel to make it possible to load my own key which does not have to be signed with an in-kernel key. EVM is not configured, only IMA.
dracut's itegrity module [1] tries to load the public key inside initrd, but receives -EPERM:
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: /lib/dracut-lib.sh@431(source_all): . //lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@3(source): SECURITYFSDIR=/sys/kernel/security
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@4(source): IMASECDIR=/sys/kernel/security/ima
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@5(source): IMACONFIG=/sysroot/etc/sysconfig/ima
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@43(source): '[' '!' -e /sys/kernel/security/ima ']'
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[565]: ////lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@51(source): keyctl describe %keyring:.ima
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[565]: Can't find 'keyring:.ima'
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@51(source): line=
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@52(source): '[' 1 -eq 0 ']'
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[566]: ////lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@55(source): keyctl search @u keyring _ima
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[566]: keyctl_search: Required key not available
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@55(source): _ima_id=
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@56(source): '[' -z '' ']'
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[567]: ////lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@57(source): keyctl newring _ima @u
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@57(source): _ima_id=541363765
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@62(source): load_x509_keys 541363765
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@9(load_x509_keys): KEYRING_ID=541363765
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@12(load_x509_keys): '[' -f /sysroot/etc/sysconfig/ima ']'
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@16(load_x509_keys): '[' -z '' ']'
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@17(load_x509_keys): IMAKEYSDIR=/etc/keys/ima
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[568]: ////lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@20(load_x509_keys): ls /sysroot/etc/keys/ima/x509_evm.der
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@20(load_x509_keys): PUBKEY_LIST=/sysroot/etc/keys/ima/x509_evm.der
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@21(load_x509_keys): for PUBKEY in ${PUBKEY_LIST}
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[554]: ///lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@23(load_x509_keys): '[' '!' -f /sysroot/etc/keys/ima/x509_evm.der ']'
> янв 13 14:06:36 rosa2019.1 dracut-pre-pivot[569]: ////lib/dracut/hooks/pre-pivot/61-ima-keys-load.sh@30(load_x509_keys): evmctl import /sysroot/etc/keys/ima/x509_evm.der 541363765
> янв 13 14:06:38 rosa2019.1 kernel: random: crng init done
> янв 13 14:06:38 rosa2019.1 kernel: random: 7 urandom warning(s) missed due to ratelimiting
> янв 13 14:06:38 rosa2019.1 dracut-pre-pivot[569]: Reading to /sysroot/etc/keys/ima/x509_evm.der
> янв 13 14:06:38 rosa2019.1 dracut-pre-pivot[569]: Importing public key 5ac982c4 from file /sysroot/etc/keys/ima/x509_evm.der into keyring 541363765
> янв 13 14:06:38 rosa2019.1 dracut-pre-pivot[569]: add_key failed
> янв 13 14:06:38 rosa2019.1 dracut-pre-pivot[569]: errno: Permission denied (13)
So, evmctl import /sysroot/etc/keys/ima/x509_evm.der 541363765 got -EPERM from the kernel.
Now I do exactly the same in already booted system... and it works, no -EPERM!
[root@rosa2019 ima-certs]# evmctl import /etc/keys/ima/x509_evm.der 541363765
Reading to /etc/keys/ima/x509_evm.der
Importing public key 5ac982c4 from file /etc/keys/ima/x509_evm.der into keyring 541363765
keyid: 483258747
483258747
[root@rosa2019 ima-certs]# cat /proc/keys | grep ima
20448e35 I--Q--- 2 perm 3f010000 0 0 keyring _ima: 1
Here are related kernel config parts:
> [root@rosa2019 ima-certs]# cat /boot/config-5.10.4-generic-5rosa2019.1-x86_64 | grep -E '_IMA|INTEGRITY'
> CONFIG_BLK_DEV_INTEGRITY=y
> CONFIG_BLK_DEV_INTEGRITY_T10=y
> CONFIG_DM_INTEGRITY=m
> CONFIG_FB_CFB_IMAGEBLIT=y
> CONFIG_FB_SYS_IMAGEBLIT=m
> # CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
> CONFIG_INTEGRITY=y
> CONFIG_INTEGRITY_SIGNATURE=y
> CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
> # CONFIG_INTEGRITY_TRUSTED_KEYRING is not set
> CONFIG_INTEGRITY_PLATFORM_KEYRING=y
> CONFIG_INTEGRITY_AUDIT=y
> CONFIG_IMA=y
> CONFIG_IMA_MEASURE_PCR_IDX=10
> CONFIG_IMA_LSM_RULES=y
> # CONFIG_IMA_TEMPLATE is not set
> CONFIG_IMA_NG_TEMPLATE=y
> # CONFIG_IMA_SIG_TEMPLATE is not set
> CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
> CONFIG_IMA_DEFAULT_HASH_SHA1=y
> # CONFIG_IMA_DEFAULT_HASH_SHA256 is not set
> # CONFIG_IMA_DEFAULT_HASH_SHA512 is not set
> CONFIG_IMA_DEFAULT_HASH="sha1"
> # CONFIG_IMA_WRITE_POLICY is not set
> CONFIG_IMA_READ_POLICY=y
> CONFIG_IMA_APPRAISE=y
> # CONFIG_IMA_ARCH_POLICY is not set
> # CONFIG_IMA_APPRAISE_BUILD_POLICY is not set
> CONFIG_IMA_APPRAISE_BOOTPARAM=y
> CONFIG_IMA_APPRAISE_MODSIG=y
> # CONFIG_IMA_TRUSTED_KEYRING is not set
> # CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY is not set
> CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y
> CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y
> # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
> [root@rosa2019 ima-certs]# cat /proc/cmdline
> BOOT_IMAGE=/@rosa201910/boot/vmlinuz-5.10.4-generic-5rosa2019.1-x86_64 root=UUID=745b0c43-6a82-4bce-9821-7f5dd88a9246 ro rootflags=subvol=@rosa201910 ima_appraise=log rd.shell rd.debug resume=UUID=59b4ab95-b679-4c7c-8272-253715edc865
> [root@rosa2019 ima-certs]#
I do not have ideas how it may happen. Kernel keyring _ima was created by dracut, then evemctl from initrd got -EPERM, but then evmctl worked OK with exectly the same keyring from booted system. Could some one please help to track the issue?
# evmctl --version
evmctl 1.3.2
Thanks!
[1] https://github.com/dracutdevs/dracut/tree/master/modules.d/98integrity
