On Wed, Oct 19, 2022 at 11:59:40AM -0700, Kees Cook wrote: Good morning, I hope the week is ending well for everyone. > On Wed, Oct 19, 2022 at 10:34:48AM -0400, Mimi Zohar wrote: > > > > The only thing trivial about making IMA and EVM LSMs is moving > > them to LSM hooks. Although static files may be signed and the > > signatures distributed with the file data through the normal > > distribution mechanisms (e.g. RPM), other files cannot be signed > > remotely (e.g. configuration files). For these files, both IMA > > and EVM may be configured to maintain persistent file state stored > > as security xattrs in the form of security.ima file hashes or > > security.evm HMACs. The LSM flexibility of enabling/disabling IMA > > or EVM on a per boot basis breaks this usage, potentially > > preventing subsequent boots. > I'm not suggesting IMA and EVM don't have specific behaviors that > need to be correctly integrated into the LSM infrastructure. In > fact, I spent a lot of time designing that infrastructure to be > flexible enough to deal with these kinds of things. (e.g. plumbing > "enablement", etc.) As I mentioned, this was more of trying to > provide a head-start on the conversion. I don't intend to drive this > -- please take whatever is useful from this example and use it. :) > I'm happy to help construct any missing infrastructure needed > (e.g. LSM_ORDER_LAST, etc). We are 2-3 weeks out from submitting for review and inclusion in the kernel, a new LSM, and an associated userspace stack, that will have a high degree of significance with respect to these conversations. > Kees Cook Best wishes for a pleasant fall weekend. As always, Dr. Greg The Quixote Project - Flailing at the Travails of Cybersecurity
