On Tue, 2024-11-26 at 00:13 +0000, Eric Snowberg wrote: > > > On Nov 19, 2024, at 3:49 AM, Roberto Sassu <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > > > > From: Roberto Sassu <roberto.sassu@xxxxxxxxxx> > > > > The Integrity Digest Cache can also help IMA for appraisal. IMA can simply > > lookup the calculated digest of an accessed file in the list of digests > > extracted from package headers, after verifying the header signature. It is > > sufficient to verify only one signature for all files in the package, as > > opposed to verifying a signature for each file. > > Is there a way to maintain integrity over time? Today if a CVE is discovered > in a signed program, the program hash can be added to the blacklist keyring. > Later if IMA appraisal is used, the signature validation will fail just for that > program. With the Integrity Digest Cache, is there a way to do this? As far as I can see, the ima_check_blacklist() call is before ima_appraise_measurement(). If it fails, appraisal with the Integrity Digest Cache will not be done. In the future, we might use the Integrity Digest Cache for blacklists too. Since a digest cache is reset on a file/directory change, IMA would have to revalidate the program digest against a new digest cache. Thanks Roberto
