evm: re-release
EVM protects a file's security extended attributes(xattrs) against integrity
attacks. This patchset provides the framework and an initial method. The
initial method maintains an HMAC-sha1 value across the security extended
attributes, storing the HMAC value as the extended attribute 'security.evm'.
Other methods of validating the integrity of a file's metadata will be posted
separately (eg. EVM-digital-signatures).
While this patchset does authenticate the security xattrs, and
cryptographically binds them to the inode, coming extensions will bind other
directory and inode metadata for more complete protection. To help simplify
the review and upstreaming process, each extension will be posted separately
(eg. IMA-appraisal, IMA-appraisal-directory). For a general overview of the
proposed Linux integrity subsystem, refer to Dave Safford's whitepaper:
http://downloads.sf.net/project/linux-ima/linux-ima/Integrity_overview.pdf.
EVM depends on the Kernel Key Retention System to provide it with a
trusted/encrypted key for the HMAC-sha1 operation. The key is loaded onto the
root's keyring using keyctl. Until EVM receives notification that the key has
been successfully loaded onto the keyring (echo 1 > <securityfs>/evm), EVM can
not create or validate the 'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
Loading the key and signaling EVM should be done as early as possible. Normally
this is done in the initramfs, which has already been measured as part of the
trusted boot. For more information on creating and loading existing
trusted/encrypted keys, refer to Documentation/keys-trusted-encrypted.txt. A
sample dracut patch, which loads the trusted/encrypted key and enables EVM, is
available from http://linux-ima.sourceforge.net/#EVM.
Based on the LSMs enabled, the set of EVM protected security xattrs is defined
at compile. EVM adds the following three calls to the existing security hooks:
evm_inode_setxattr(), evm_inode_post_setxattr(), and evm_inode_removexattr. To
initialize and update the 'security.evm' extended attribute, EVM defines three
calls: evm_inode_post_init(), evm_inode_post_setattr() and
evm_inode_post_removexattr() hooks. To verify the integrity of a security
xattr, EVM exports evm_verifyxattr().
Changelog v7:
- Fixed URL in EVM ABI documentation
Changelog v6: (based on Serge Hallyn's review)
- fix URL in patch description
- remove evm_hmac_size definition
- use SHA1_DIGEST_SIZE (removed both MAX_DIGEST_SIZE and evm_hmac_size)
- moved linux include before other includes
- test for crypto_hash_setkey failure
- fail earlier for invalid key
- clear entire encrypted key, even on failure
- check xattr name length before comparing xattr names
Changelog:
- locking based on i_mutex, remove evm_mutex
- using trusted/encrypted keys for storing the EVM key used in the HMAC-sha1
operation.
- replaced crypto hash with shash (Dmitry Kasatkin)
- support for additional methods of verifying the security xattrs
(Dmitry Kasatkin)
- iint not allocated for all regular files, but only for those appraised
- Use cap_sys_admin in lieu of cap_mac_admin
- Use __vfs_setxattr_noperm(), without permission checks, from EVM
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
2011-03-16 05:12:09 +09:00
|
|
|
What: security/evm
|
|
|
|
|
Date: March 2011
|
|
|
|
|
Contact: Mimi Zohar <zohar@us.ibm.com>
|
|
|
|
|
Description:
|
|
|
|
|
EVM protects a file's security extended attributes(xattrs)
|
|
|
|
|
against integrity attacks. The initial method maintains an
|
|
|
|
|
HMAC-sha1 value across the extended attributes, storing the
|
|
|
|
|
value as the extended attribute 'security.evm'.
|
|
|
|
|
|
2017-10-12 04:10:14 +09:00
|
|
|
EVM supports two classes of security.evm. The first is
|
|
|
|
|
an HMAC-sha1 generated locally with a
|
|
|
|
|
trusted/encrypted key stored in the Kernel Key
|
|
|
|
|
Retention System. The second is a digital signature
|
|
|
|
|
generated either locally or remotely using an
|
|
|
|
|
asymmetric key. These keys are loaded onto root's
|
|
|
|
|
keyring using keyctl, and EVM is then enabled by
|
|
|
|
|
echoing a value to <securityfs>/evm:
|
|
|
|
|
|
|
|
|
|
1: enable HMAC validation and creation
|
|
|
|
|
2: enable digital signature validation
|
|
|
|
|
3: enable HMAC and digital signature validation and HMAC
|
|
|
|
|
creation
|
|
|
|
|
|
|
|
|
|
Further writes will be blocked if HMAC support is enabled or
|
|
|
|
|
if bit 32 is set:
|
|
|
|
|
|
|
|
|
|
echo 0x80000002 ><securityfs>/evm
|
|
|
|
|
|
|
|
|
|
will enable digital signature validation and block
|
|
|
|
|
further writes to <securityfs>/evm.
|
|
|
|
|
|
|
|
|
|
Until this is done, EVM can not create or validate the
|
|
|
|
|
'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
|
|
|
|
|
Loading keys and signaling EVM should be done as early
|
|
|
|
|
as possible. Normally this is done in the initramfs,
|
|
|
|
|
which has already been measured as part of the trusted
|
|
|
|
|
boot. For more information on creating and loading
|
|
|
|
|
existing trusted/encrypted keys, refer to:
|
2017-11-14 03:41:25 +09:00
|
|
|
|
|
|
|
|
Documentation/security/keys/trusted-encrypted.rst. Both dracut
|
2017-10-12 04:10:14 +09:00
|
|
|
(via 97masterkey and 98integrity) and systemd (via
|
|
|
|
|
core/ima-setup) have support for loading keys at boot
|
|
|
|
|
time.
|