From: Mauro Carvalho Chehab [mailto:mchehab+huawei@kernel.org] Sent: Wednesday, July 28, 2021 2:47 PM Em Mon, 26 Jul 2021 18:36:59 +0200 Roberto Sassu roberto.sassu@huawei.com escreveu:
Add more information about remote attestation with IMA and DIGLIM in Documentation/security/diglim/remote_attestation.rst.
Signed-off-by: Roberto Sassu roberto.sassu@huawei.com
Documentation/security/diglim/index.rst | 1 + .../security/diglim/remote_attestation.rst | 87 +++++++++++++++++++ MAINTAINERS | 1 + 3 files changed, 89 insertions(+) create mode 100644 Documentation/security/diglim/remote_attestation.rst
diff --git a/Documentation/security/diglim/index.rst
b/Documentation/security/diglim/index.rst
index 4771134c2f0d..0f28c5ad71c0 100644 --- a/Documentation/security/diglim/index.rst +++ b/Documentation/security/diglim/index.rst @@ -10,3 +10,4 @@ Digest Lists Integrity Module (DIGLIM) introduction architecture implementation
- remote_attestation
diff --git a/Documentation/security/diglim/remote_attestation.rst
b/Documentation/security/diglim/remote_attestation.rst
new file mode 100644 index 000000000000..83fd7581c460 --- /dev/null +++ b/Documentation/security/diglim/remote_attestation.rst @@ -0,0 +1,87 @@ +.. SPDX-License-Identifier: GPL-2.0
+Remote Attestation +==================
+When a digest list is added or deleted through the ``digest_list_add`` or +``digest_list_del`` interfaces, its buffer is sent to the IMA function +``ima_measure_critical_data()``. The primary reason for it is to calculate +the buffer digest, so that the digest list itself is searchable in the hash +table.
+``ima_measure_critical_data()`` can be also used to create a new +measurement entry each time this function is called, if there is an +appropriate rule in the IMA policy. Given that this function is called +during an addition or deletion of a digest list, a remote verifier can +infer from the measurement list precise information about what has been +uploaded to the kernel.
+To enable this functionality, the following rule must be added to the IMA +policy:
+::
As commented on other patches at this series, you can merge :: at the previous text line, e. g.:
policy::
does the same as:
policy:
::
but it is nicer for text-only readers, IMO.
Ok, will change in the next version of the patch set.
Thanks
Roberto
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli
- measure func=CRITICAL_DATA label=diglim
+When a file is uploaded, the workflow and the resulting IMA measurement +list are:
+.. code-block:: bash
- # echo $PWD/0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_list_add
- # echo $PWD/0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_list_del
- # cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements
- ...
- 10 <template digest> ima-buf sha256:<buffer digest> add_file_0-file_list-
compact-cat <buffer>
- 10 <template digest> ima-buf sha256:<buffer digest> del_file_0-file_list-
compact-cat <buffer>
+When a buffer is uploaded, the workflow and the resulting IMA
measurement
+list are:
+.. code-block:: bash
- # echo 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_label
- # cat 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_list_add
- # echo 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_label
- # cat 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_list_del
- # cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements
- ...
- 10 <template digest> ima-buf sha256:<buffer digest> add_buffer_0-
file_list-compact-cat <buffer>
- 10 <template digest> ima-buf sha256:<buffer digest> del_buffer_0-file_list-
compact-cat <buffer>
+In the second case, the digest list label must be set explicitly, as the +kernel cannot determine it by itself (in the first case it is derived from +the name of the file uploaded).
+The confirmation that the digest list has been processed by IMA can be +obtained by reading the ASCII representation of the digest list:
+.. code-block:: bash
- # cat /sys/kernel/security/integrity/diglim/digest_lists_loaded/sha256-
<digest list digest>-0-file_list-compact-cat.ascii
- actions: 1, version: 1, algo: sha256, type: 2, modifiers: 1, count: 1, datalen:
32
87e5bd81850e11eeec2d3bb696b626b2a7f45673241cbbd64769c83580432869
+In this output, ``actions`` is set to 1
(``COMPACT_ACTION_IMA_MEASURED``
+bit set).
+DIGLIM guarantees that the information reported in the IMA measurement
list
+is complete. If digest list loading is not recorded, digest query results +are ignored by IMA. If the addition was recorded, deletion can be
performed
+only if also the deletion is recorded. This can be seen in the following +sequence of commands:
+.. code-block:: bash
- # echo 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_label
- # cat 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_list_add
- # echo 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_label
- # /tmp/cat 0-file_list-compact-cat >
/sys/kernel/security/integrity/diglim/digest_list_del
- diglim: actions mismatch, add: 1, del: 0
- diglim: unable to upload generated digest list
- /tmp/cat: write error: Invalid argument
+Digest list measurement is avoided with the execution of ``/tmp/cat``, for +which a dont_measure rule was previously added in the IMA policy. diff --git a/MAINTAINERS b/MAINTAINERS index 0672128fae7f..a7c502685109 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5461,6 +5461,7 @@ F:
Documentation/security/diglim/architecture.rst
F: Documentation/security/diglim/implementation.rst F: Documentation/security/diglim/index.rst F: Documentation/security/diglim/introduction.rst +F: Documentation/security/diglim/remote_attestation.rst F: include/linux/diglim.h F: include/uapi/linux/diglim.h F: security/integrity/diglim/diglim.h