> From: Mauro Carvalho Chehab [mailto:mchehab+huawei@xxxxxxxxxx] > Sent: Wednesday, July 28, 2021 2:47 PM > Em Mon, 26 Jul 2021 18:36:59 +0200 > Roberto Sassu <roberto.sassu@xxxxxxxxxx> escreveu: > > > Add more information about remote attestation with IMA and DIGLIM in > > Documentation/security/diglim/remote_attestation.rst. > > > > Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx> > > --- > > Documentation/security/diglim/index.rst | 1 + > > .../security/diglim/remote_attestation.rst | 87 +++++++++++++++++++ > > MAINTAINERS | 1 + > > 3 files changed, 89 insertions(+) > > create mode 100644 Documentation/security/diglim/remote_attestation.rst > > > > diff --git a/Documentation/security/diglim/index.rst > b/Documentation/security/diglim/index.rst > > index 4771134c2f0d..0f28c5ad71c0 100644 > > --- a/Documentation/security/diglim/index.rst > > +++ b/Documentation/security/diglim/index.rst > > @@ -10,3 +10,4 @@ Digest Lists Integrity Module (DIGLIM) > > introduction > > architecture > > implementation > > + remote_attestation > > diff --git a/Documentation/security/diglim/remote_attestation.rst > b/Documentation/security/diglim/remote_attestation.rst > > new file mode 100644 > > index 000000000000..83fd7581c460 > > --- /dev/null > > +++ b/Documentation/security/diglim/remote_attestation.rst > > @@ -0,0 +1,87 @@ > > +.. SPDX-License-Identifier: GPL-2.0 > > + > > +Remote Attestation > > +================== > > + > > +When a digest list is added or deleted through the ``digest_list_add`` or > > +``digest_list_del`` interfaces, its buffer is sent to the IMA function > > +``ima_measure_critical_data()``. The primary reason for it is to calculate > > +the buffer digest, so that the digest list itself is searchable in the hash > > +table. > > + > > +``ima_measure_critical_data()`` can be also used to create a new > > +measurement entry each time this function is called, if there is an > > +appropriate rule in the IMA policy. Given that this function is called > > +during an addition or deletion of a digest list, a remote verifier can > > +infer from the measurement list precise information about what has been > > +uploaded to the kernel. > > + > > +To enable this functionality, the following rule must be added to the IMA > > +policy: > > + > > +:: > > As commented on other patches at this series, you can merge :: at the > previous text line, e. g.: > > policy:: > > does the same as: > > policy: > > :: > > but it is nicer for text-only readers, IMO. Ok, will change in the next version of the patch set. Thanks Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli > > + > > + measure func=CRITICAL_DATA label=diglim > > + > > + > > +When a file is uploaded, the workflow and the resulting IMA measurement > > +list are: > > + > > +.. code-block:: bash > > + > > + # echo $PWD/0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_list_add > > + # echo $PWD/0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_list_del > > + # cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements > > + ... > > + 10 <template digest> ima-buf sha256:<buffer digest> add_file_0-file_list- > compact-cat <buffer> > > + 10 <template digest> ima-buf sha256:<buffer digest> del_file_0-file_list- > compact-cat <buffer> > > + > > +When a buffer is uploaded, the workflow and the resulting IMA > measurement > > +list are: > > + > > +.. code-block:: bash > > + > > + # echo 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_label > > + # cat 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_list_add > > + # echo 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_label > > + # cat 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_list_del > > + # cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements > > + ... > > + 10 <template digest> ima-buf sha256:<buffer digest> add_buffer_0- > file_list-compact-cat <buffer> > > + 10 <template digest> ima-buf sha256:<buffer digest> del_buffer_0-file_list- > compact-cat <buffer> > > + > > +In the second case, the digest list label must be set explicitly, as the > > +kernel cannot determine it by itself (in the first case it is derived from > > +the name of the file uploaded). > > + > > +The confirmation that the digest list has been processed by IMA can be > > +obtained by reading the ASCII representation of the digest list: > > + > > +.. code-block:: bash > > + > > + # cat /sys/kernel/security/integrity/diglim/digest_lists_loaded/sha256- > <digest list digest>-0-file_list-compact-cat.ascii > > + actions: 1, version: 1, algo: sha256, type: 2, modifiers: 1, count: 1, datalen: > 32 > > + > 87e5bd81850e11eeec2d3bb696b626b2a7f45673241cbbd64769c83580432869 > > + > > +In this output, ``actions`` is set to 1 > (``COMPACT_ACTION_IMA_MEASURED`` > > +bit set). > > + > > + > > +DIGLIM guarantees that the information reported in the IMA measurement > list > > +is complete. If digest list loading is not recorded, digest query results > > +are ignored by IMA. If the addition was recorded, deletion can be > performed > > +only if also the deletion is recorded. This can be seen in the following > > +sequence of commands: > > + > > +.. code-block:: bash > > + > > + # echo 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_label > > + # cat 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_list_add > > + # echo 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_label > > + # /tmp/cat 0-file_list-compact-cat > > /sys/kernel/security/integrity/diglim/digest_list_del > > + diglim: actions mismatch, add: 1, del: 0 > > + diglim: unable to upload generated digest list > > + /tmp/cat: write error: Invalid argument > > + > > +Digest list measurement is avoided with the execution of ``/tmp/cat``, for > > +which a dont_measure rule was previously added in the IMA policy. > > diff --git a/MAINTAINERS b/MAINTAINERS > > index 0672128fae7f..a7c502685109 100644 > > --- a/MAINTAINERS > > +++ b/MAINTAINERS > > @@ -5461,6 +5461,7 @@ F: > Documentation/security/diglim/architecture.rst > > F: Documentation/security/diglim/implementation.rst > > F: Documentation/security/diglim/index.rst > > F: Documentation/security/diglim/introduction.rst > > +F: Documentation/security/diglim/remote_attestation.rst > > F: include/linux/diglim.h > > F: include/uapi/linux/diglim.h > > F: security/integrity/diglim/diglim.h
