From: Mimi Zohar [mailto:zohar@linux.ibm.com] Sent: Tuesday, September 1, 2020 1:05 PM On Tue, 2020-09-01 at 09:08 +0000, Roberto Sassu wrote:
From: Mimi Zohar [mailto:zohar@linux.ibm.com] Sent: Monday, August 24, 2020 2:18 PM On Thu, 2020-06-18 at 18:04 +0200, Roberto Sassu wrote:
When EVM_ALLOW_METADATA_WRITES is set, EVM allows any
operation
on
metadata. Its main purpose is to allow users to freely set metadata
when
they are protected by a portable signature, until the HMAC key is
loaded.
However, IMA is not notified about metadata changes and, after the
first
appraisal, always allows access to the files without checking metadata again.
^after the first successful appraisal
This patch checks in evm_reset_status() if EVM_ALLOW_METADATA
WRITES is
enabled and if it is, sets the IMA_CHANGE_XATTR/ATTR bits
depending on
the
operation performed. At the next appraisal, metadata are revalidated.
EVM modifying IMA bits crosses the boundary between EVM and IMA. There is already an IMA post_setattr hook. IMA could reset its own bit there. If necessary EVM could export as a function it's status info.
I wouldn't try to guess in IMA when EVM resets its status. We would have to duplicate the logic to check if an EVM key is loaded, if the passed xattr is a POSIX ACL, ...
Agreed, but IMA could call an EVM function.
I think it is better to set a flag, maybe a new one, directly in EVM, to notify the integrity subsystem that iint->evm_status is no longer valid.
If the EVM flag is set, IMA would reset the appraisal flags, as it uses iint->evm_status for appraisal. We can consider to reset also the measure flags when we have a template that includes file metadata.
When would IMA read the EVM flag? Who would reset the flag? At what point would it be reset? Just as EVM shouldn't be resetting the IMA flag, IMA shouldn't be resetting the EVM flag.
IMA would read the flag in process_measurement() and behave similarly to when it processes IMA_CHANGE_ATTR. The flag would be reset by evm_verify_hmac().
Roberto
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli