On Tue, 2024-11-26 at 00:13 +0000, Eric Snowberg wrote:
On Nov 19, 2024, at 3:49 AM, Roberto Sassu roberto.sassu@huaweicloud.com wrote:
From: Roberto Sassu roberto.sassu@huawei.com
The Integrity Digest Cache can also help IMA for appraisal. IMA can simply lookup the calculated digest of an accessed file in the list of digests extracted from package headers, after verifying the header signature. It is sufficient to verify only one signature for all files in the package, as opposed to verifying a signature for each file.
Is there a way to maintain integrity over time? Today if a CVE is discovered in a signed program, the program hash can be added to the blacklist keyring. Later if IMA appraisal is used, the signature validation will fail just for that program. With the Integrity Digest Cache, is there a way to do this?
As far as I can see, the ima_check_blacklist() call is before ima_appraise_measurement(). If it fails, appraisal with the Integrity Digest Cache will not be done.
In the future, we might use the Integrity Digest Cache for blacklists too. Since a digest cache is reset on a file/directory change, IMA would have to revalidate the program digest against a new digest cache.
Thanks
Roberto