Unverified Commit 0e6ac87d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3880 ima: Add IMA digest lists extension 

Merge Pull Request from: @zgzxx 
 
add IMA digest lists extension

issue:
https://gitee.com/openeuler/kernel/issues/I91FSN

support to measure and appraise files with digest lists

Test:
The measurement and appraisement functions are verified successfully.

Known issue:NA

Default config change:
if any recommended config change vs upstream default config, please list as git diff format:
< CONFIG_INITRAMFS_FILE_METADATA=""
< CONFIG_IMA_DIGEST_LIST=y
< CONFIG_IMA_DIGEST_LISTS_DIR="/etc/ima/digest_lists"
< CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y
< # CONFIG_IMA_MAX_DIGEST_DB_SIZE is not set
< # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set
< CONFIG_IMA_DIGEST_DB_MEGABYTES=16
< CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists"
< CONFIG_EVM_DEFAULT_HASH_SHA1=n
< CONFIG_EVM_DEFAULT_HASH_SHA256=y
< CONFIG_EVM_DEFAULT_HASH_SHA512=n
< CONFIG_PGP_LIBRARY=y
< CONFIG_PGP_KEY_PARSER=y
< CONFIG_PGP_PRELOAD=y
< CONFIG_PGP_PRELOAD_PUBLIC_KEYS=y

Reference：https://lwn.net/Articles/791220/
https://patchwork.kernel.org/project/linux-crypto/cover/20181112102423.30415-1-roberto.sassu@huawei.com/； 
 
Link:https://gitee.com/openeuler/kernel/pulls/3880

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Reviewed-by: default avatarZhu Jianwei <zhujianwei7@huawei.com>
Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents 08381767 f27db89e

Documentation/admin-guide/kernel-parameters.txt

+45 −4
Original line number Diff line number Diff line
@@ -1491,9 +1491,13 @@ 
			has equivalent usage. See its documentation for details.



	evm=		[EVM]

			Format: { "fix" }

			Permit 'security.evm' to be updated regardless of

			current integrity status.

			Format: { "fix" | "x509" | "allow_metadata_writes" |

				  "complete" }

			fix: permit 'security.evm' to be updated regardless of

			current integrity status;

			x509: enable EVM by setting x509 flag;

			allow_metadata_writes: permit metadata modificatons;

			complete: don't allow further changes of the EVM status.



	early_page_ext [KNL] Enforces page_ext initialization to earlier

			stages so cover more early boot allocations.
@@ -1986,9 +1990,19 @@ 
			Set number of hash buckets for inode cache.



	ima_appraise=	[IMA] appraise integrity measurements

			Format: { "off" | "enforce" | "fix" | "log" }

			Format: { "off" | "enforce" | "fix" | "log" |

				  "enforce-evm" | "log-evm" }

			default: "enforce"



	ima_appraise_digest_list= [IMA]

			Format: { "digest" | "digest-nometadata" }



			digest: enables appraisal of files with digest lists

			until EVM is initialized.



			digest-nometadata: enables appraisal of files with

			digest lists even after EVM is initialized.



	ima_appraise_tcb [IMA] Deprecated.  Use ima_policy= instead.

			The builtin appraise policy appraises all files

			owned by uid=0.
@@ -1997,6 +2011,19 @@ 
			Use the canonical format for the binary runtime

			measurements, instead of host native format.



	ima_digest_list_pcr=

			[IMA]

			Specify which PCR is extended when file digests are

			not found in the loaded digest lists. If '+' is not

			specified, no measurement entry is created if the

			digest is found. Otherwise, IMA creates also entries

			with PCR 10, according to the existing behavior.

			Format: { [+]<unsigned int> }



	ima_digest_db_size=nn[M]

			[IMA]

			Sets the maximum data uploaded to IMA digest database.



	ima_hash=	[IMA]

			Format: { md5 | sha1 | rmd160 | sha256 | sha384

				   | sha512 | ... }
@@ -2015,6 +2042,11 @@ 
			mode bit set by either the effective uid (euid=0) or

			uid=0.



			The "exec_tcb" policy is similar to the "tcb" policy

			except for file open, which is not considered. Files

			in the tmpfs filesystem are not excluded from

			measurement.



			The "appraise_tcb" policy appraises the integrity of

			all files owned by root.
@@ -2022,6 +2054,15 @@ 
			of files (eg. kexec kernel image, kernel modules,

			firmware, policy, etc) based on file signatures.



			The "appraise_exec_tcb" includes the "secure_boot"

			policy and additionally includes all programs exec'd and

			files mmap'd for exec. Files in the tmpfs filesystem are

			not excluded from appraisal.



			The "appraise_exec_immutable" policy requires immutable

			metadata for executed files, if the "appraise_exec_tcb"

			policy is selected.



			The "fail_securely" policy forces file signature

			verification failure also on privileged mounted

			filesystems with the SB_I_UNVERIFIABLE_SIGNATURE

Documentation/security/IMA-digest-lists.txt

0 → 100644
+259 −0
Original line number Diff line number Diff line 
==========================

IMA Digest Lists Extension

==========================



INTRODUCTION

============



Integrity Measurement Architecture (IMA) is a security module that performs

measurement of files accessed with the execve(), mmap() and open() system

calls. File measurements can be used for different purposes. They can be

added in a measurement list and sent to a remote verifier for an integrity

evaluation. They can be compared to reference values provided by the

software vendor and access can be denied if there is a mismatch. File

measurements can also be included in system logs for auditing purposes.



IMA Digest Lists is an extension providing additional functionality for

the IMA submodules and EVM. Its main task is to load reference values for

file content and metadata in the kernel memory, and to communicate to IMA

submodules (measurement and appraisal) or EVM whether the digest of a file

being accessed is found in the uploaded digest lists.



The IMA-Measure submodule uses the IMA Digest Lists extension to create

a new measurement list (with a different PCR, for example 11) which

contains the measurement of uploaded digest lists and unknown files. Since

the loading of digest lists is sequential, the chosen PCR will have a

predictable value for the whole boot cycle and can be used for sealing

policies based on the OS software integrity.



Both the standard and the new measurement list can be generated at the same

time, allowing for implicit attestation based on the usage of a TPM key

sealed to the OS, and for explicit attestation when a more precise

integrity evaluation is necessary.



The IMA-Appraise submodule uses the IMA Digest Lists extension to

grant/deny access to the files depending on whether the file digest is

found in the uploaded digest lists, instead of checking security.ima.



EVM uses the IMA Digest Lists extension to check file metadata integrity.



The main advantage of the extension is that reference measurements used for

the digest comparison can be extracted from already existing sources (for

example RPM headers). Another benefit is that the overhead compared to file

signatures is lower as only one signature is verified for all files

included in the digest list.







WORKFLOW

========



The IMA workflow is modified as follows. The added steps are marked as

[NEW].



  +------------+

  |  IMA hook  |

  +------------+

        |

   +---------+

   | collect |

   +---------+

        |                                           +---------------------+

+---------------+                       ------------| don't measure [NEW] |

| digest lookup |                       | yes       +---------------------+

|     [NEW]     |                 -------------- no +---------------------+

+---------------+           -----/ digest       \---| add to measurement  |

        |                   |    \ found? [NEW] /   | list (PCR 11) [NEW] |

        |                   |     --------------    +---------------------+

  +----------+       +-------------+                +--------------------+

  |  switch  |-------| IMA-Measure |----------------| add to measurement |

  | (action) |       +-------------+                | list (PCR 10)      |

  +----------+                                      +--------------------+

        |

        |

        |       no xattr

+--------------+     ---------------  yes

| IMA-Appraise |----/ filec created \-------------------------------

+--------------+    \ created [NEW] /                              |

  xattr |            ---------------                               |

        |                   | no                                   |

        |           ------------------  no  --------------  yes  +--------+

        |          / EVM initialized? \----/ digest       \------| grant  |

        |          \ [NEW]            /    \ found? [NEW] /      | access |

        |           ------------------      --------------       +--------+

        |                   | yes                 | no

        |                   |                     |              +--------+

        |           -------------------  no       ---------------| deny   |

        |          / digest-nometadata \-------------------------| access |

        |          \ mode? [NEW]       /                         +--------+

        |           -------------------

        |               ^   | yes                                +--------+

        |               |   -------------------------------------| grant  |

        |               |                                        | access |

        |               |                                        +--------+

        |               | yes

        |           -------------------------  no                +--------+

        |----------/ security.ima (new type) \-------------------| deny   |

        |          \ present and valid?      /                   | access |

        |           -------------------------                    +--------+

        |                                                            |

        |           --------------------------  no                   |

        -----------/ security.ima (cur types) \-----------------------

                   \ present and valid?       /

                    --------------------------

                             | yes                               +--------+

                             ------------------------------------| grant  |

                                                                 | access |

                                                                 +--------+





+-----+          --------------------------  yes                 +--------+

| EVM |---------/ security.evm (cur types) \---------------------| grant  |

+-----+         \ present and valid?       /                     | access |

   |             --------------------------                      +--------+

   |                         |

   |                         | no                                +--------+

   |                         ------------------------------------| deny   |

   |                                                             | access |

   |                                                             +--------+

   |                                                                 |

   |                                          +-----------+          |

   |             -------------------------    | calculate |          |

   -------------/ security.evm (new type) \---| metadata  |          |

                \ present? [NEW]          /   | digest    |          |

                 -------------------------    +-----------+          |

                                                    |                |

                                              --------------  no     |

                                             / digest       \---------

                                             \ found? [NEW] /

                                              --------------     +--------+

                                                    | yes        | grant  |

                                                    |            | access |

                                                    |            +--------+

                                                    |                |

                                             ------------------  yes |

                                            / digest           \-----|

                                            \ immutable? [NEW] /     |

                                             ------------------      |

                                                    | no             |

                                               +---------+           |

                                               | convert |------------

                                               | to HMAC |

                                               +---------+





After the file digest is calculated, it is searched in the hash table

containing all digests extracted from the uploaded digest lists. Then, if

the digest is found, a structure is returned to IMA with information

associated to that digest. The structure is returned only to the IMA

submodules that processed the digest lists (i.e. the action returned by

ima_get_action() was 'measure' or 'appraise').



IMA-Measure behavior depends on whether the digest list PCR has been

specified in the kernel command line. If the PCR was not specified, the

submodule behaves as before. If the PCR was specified, IMA-Measure creates

a new measurement with that PCR, only if the file digest is not found in

the digest lists. It additionally creates a measurement with the default

PCR if '+' is added as a prefix to the PCR.



IMA-Appraise behavior depends on whether either the 'digest' or

'digest-nometadata' appraisal modes have been specified in the kernel

command line. If they were not specified, IMA-Appraise relies solely on the

security.ima xattr for verification. If the 'digest' mode was specified,

verification succeeds if the file digest is found in the digest lists and

EVM is not initialized, as there is no other way to verify file metadata.



If the 'digest-nometadata' mode was specified, verification succeeds

regardless of the fact that EVM is initialized or not. However, after a

write, files for which access was granted without verifying metadata will

have a new security.ima type, so that they can be identified also after

reboot. Specifying 'digest-nometadata' is required also to access files

with the new security.ima type.



EVM determines whether metadata digest should be searched in the digest

lists depending on the security.evm type. If the new type is set, EVM

calculates metadata digest and searches it in the digest lists. A structure

is returned to EVM if the digest is found and the digest lists were

appraised.







ARCHITECTURE

============



+-----+                    6) digest lookup

| EVM |------------------------------------------------

+-----+                                               |

                                                      |

+--------------+           5) digest lookup           |

| IMA-Appraise |--------------------------------------|

+--------------+                                     ||

                                                     ||

+-------------+            4) digest lookup          ||

| IMA-Measure | -------------------------------------||

+-------------+                                     |||

                                                    |||

+-------------+   2) parse compact list   +-------------------+

| IMA (secfs) | ------------------------> | IMA Digests Lists |

+-------------+                           +-------------------+

   ^                                                 | 3) add digests

   |                                           +------------+

   |                                           | hash table |

   |                                           +------------+

   |

   |                                                            kernel space

---|-------------------------------------------------------------------------

   |                                                            user space

   |

   |

   |

   |

   |

   |

   |

1) echo <digest list path>



The main addition to IMA is a new hash table (similar to that used to check

for duplicate measurement entries), which contains file content and metadata

digests extracted from the digest lists.



Digest lists can be uploaded to the kernel by writing their path to

digest_list_data in the securityfs filesystem. After digest lists are

uploaded, they are parsed by the kernel and extracted digests are added to

the hash table.



IMA submodules, Measure and Appraise, search the digest of an accessed file

in the hash table and perform actions depending on whether the digest was

found or not. IMA submodules can search digests in the hash table only if

they also processed the digest lists.



EVM searches the metadata digest of an accessed file in the hash table and

returns the result to IMA, which perform actions depending on the result.

EVM can search digests in the hash table if IMA-Appraise processed the

digest lists.







CONFIGURATION

=============



The first step consists in generating digest lists with the

gen_digest_lists tool included in the digest-list-tools package.

digest-list-tools can be retrieved at the URL:



https://gitee.com/openeuler/digest-list-tools



gen_digest_lists can generate digest lists from different sources (for

example: RPM package DB). By default, it saves generated digest lists in

the /etc/ima/digest_lists directory. digest-list-tools includes also two

bash scripts setup_ima_digest_lists and setup_digest_lists_demo to simplify

the digest list generation for the users.



To use digest lists during early boot, it is necessary to regenerate the

initial ram disk. Digest lists will be added to the ram disk by the new

dracut/initramfs-tools modules, included in the digest-list-tools package. To

include file signatures in the initial ram disk, it is necessary to have the

following patches applied:



https://gitee.com/src-openeuler/cpio/blob/master/add-option-to-add-metadata-in-copy-out-mode.patch

https://gitee.com/src-openeuler/dracut/blob/master/add-option-to-include-file-metadata-in-initramfs.patch

arch/arm64/configs/openeuler_defconfig

+15 −0
Original line number Diff line number Diff line
@@ -216,6 +216,7 @@ CONFIG_RD_XZ=y 
CONFIG_RD_LZO=y

CONFIG_RD_LZ4=y

CONFIG_RD_ZSTD=y

CONFIG_INITRAMFS_FILE_METADATA=""

CONFIG_BOOT_CONFIG=y

# CONFIG_BOOT_CONFIG_FORCE is not set

# CONFIG_BOOT_CONFIG_EMBED is not set
@@ -7263,11 +7264,21 @@ CONFIG_IMA_APPRAISE_BOOTPARAM=y 
CONFIG_IMA_LOAD_X509=y

CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der"

# CONFIG_IMA_APPRAISE_SIGNED_INIT is not set

CONFIG_IMA_DIGEST_LIST=y

CONFIG_IMA_DIGEST_LISTS_DIR="/etc/ima/digest_lists"

CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y

# CONFIG_IMA_MAX_DIGEST_DB_SIZE is not set

# CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set

CONFIG_IMA_DIGEST_DB_MEGABYTES=16

CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists"

CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y

CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y

# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set

# CONFIG_IMA_DISABLE_HTABLE is not set

CONFIG_EVM=y

CONFIG_EVM_DEFAULT_HASH_SHA1=n

CONFIG_EVM_DEFAULT_HASH_SHA256=y

CONFIG_EVM_DEFAULT_HASH_SHA512=n

CONFIG_EVM_ATTR_FSUUID=y

# CONFIG_EVM_ADD_XATTRS is not set

CONFIG_EVM_LOAD_X509=y
@@ -7563,6 +7574,9 @@ CONFIG_PKCS7_MESSAGE_PARSER=y 
# CONFIG_PKCS7_TEST_KEY is not set

CONFIG_SIGNED_PE_FILE_VERIFICATION=y

# CONFIG_FIPS_SIGNATURE_SELFTEST is not set

CONFIG_PGP_LIBRARY=y

CONFIG_PGP_KEY_PARSER=y

CONFIG_PGP_PRELOAD=y



#

# Certificates for signature checking
@@ -7579,6 +7593,7 @@ CONFIG_SYSTEM_BLACKLIST_HASH_LIST="" 
CONFIG_SYSTEM_REVOCATION_LIST=y

CONFIG_SYSTEM_REVOCATION_KEYS=""

# CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE is not set

CONFIG_PGP_PRELOAD_PUBLIC_KEYS=y

# end of Certificates for signature checking



CONFIG_BINARY_PRINTF=y

arch/x86/configs/openeuler_defconfig

+15 −0
Original line number Diff line number Diff line
@@ -237,6 +237,7 @@ CONFIG_RD_XZ=y 
CONFIG_RD_LZO=y

CONFIG_RD_LZ4=y

CONFIG_RD_ZSTD=y

CONFIG_INITRAMFS_FILE_METADATA=""

CONFIG_BOOT_CONFIG=y

# CONFIG_BOOT_CONFIG_FORCE is not set

# CONFIG_BOOT_CONFIG_EMBED is not set
@@ -8441,11 +8442,21 @@ CONFIG_IMA_APPRAISE_BOOTPARAM=y 
CONFIG_IMA_LOAD_X509=y

CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der"

# CONFIG_IMA_APPRAISE_SIGNED_INIT is not set

CONFIG_IMA_DIGEST_LIST=y

CONFIG_IMA_DIGEST_LISTS_DIR="/etc/ima/digest_lists"

CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y

# CONFIG_IMA_MAX_DIGEST_DB_SIZE is not set

# CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set

CONFIG_IMA_DIGEST_DB_MEGABYTES=16

CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists"

CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y

CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y

# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set

# CONFIG_IMA_DISABLE_HTABLE is not set

CONFIG_EVM=y

CONFIG_EVM_DEFAULT_HASH_SHA1=n

CONFIG_EVM_DEFAULT_HASH_SHA256=y

CONFIG_EVM_DEFAULT_HASH_SHA512=n

CONFIG_EVM_ATTR_FSUUID=y

# CONFIG_EVM_ADD_XATTRS is not set

CONFIG_EVM_LOAD_X509=y
@@ -8748,6 +8759,9 @@ CONFIG_PKCS7_MESSAGE_PARSER=y 
# CONFIG_PKCS7_TEST_KEY is not set

CONFIG_SIGNED_PE_FILE_VERIFICATION=y

# CONFIG_FIPS_SIGNATURE_SELFTEST is not set

CONFIG_PGP_LIBRARY=y

CONFIG_PGP_KEY_PARSER=y

CONFIG_PGP_PRELOAD=y



#

# Certificates for signature checking
@@ -8764,6 +8778,7 @@ CONFIG_SYSTEM_BLACKLIST_HASH_LIST="" 
CONFIG_SYSTEM_REVOCATION_LIST=y

CONFIG_SYSTEM_REVOCATION_KEYS=""

# CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE is not set

CONFIG_PGP_PRELOAD_PUBLIC_KEYS=y

# end of Certificates for signature checking



CONFIG_BINARY_PRINTF=y

certs/Kconfig

+7 −0
Original line number Diff line number Diff line
@@ -138,4 +138,11 @@ config SYSTEM_BLACKLIST_AUTH_UPDATE 
	  keyring.  The PKCS#7 signature of the description is set in the key

	  payload.  Blacklist keys cannot be removed.



config PGP_PRELOAD_PUBLIC_KEYS

	bool "Preload PGP public keys"

	select PGP_PRELOAD

	default n

	help

	  Provide a keyring of PGP public keys.



endmenu