2019-05-19 06:07:45 -06:00
|
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
evm: re-release
EVM protects a file's security extended attributes(xattrs) against integrity
attacks. This patchset provides the framework and an initial method. The
initial method maintains an HMAC-sha1 value across the security extended
attributes, storing the HMAC value as the extended attribute 'security.evm'.
Other methods of validating the integrity of a file's metadata will be posted
separately (eg. EVM-digital-signatures).
While this patchset does authenticate the security xattrs, and
cryptographically binds them to the inode, coming extensions will bind other
directory and inode metadata for more complete protection. To help simplify
the review and upstreaming process, each extension will be posted separately
(eg. IMA-appraisal, IMA-appraisal-directory). For a general overview of the
proposed Linux integrity subsystem, refer to Dave Safford's whitepaper:
http://downloads.sf.net/project/linux-ima/linux-ima/Integrity_overview.pdf.
EVM depends on the Kernel Key Retention System to provide it with a
trusted/encrypted key for the HMAC-sha1 operation. The key is loaded onto the
root's keyring using keyctl. Until EVM receives notification that the key has
been successfully loaded onto the keyring (echo 1 > <securityfs>/evm), EVM can
not create or validate the 'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
Loading the key and signaling EVM should be done as early as possible. Normally
this is done in the initramfs, which has already been measured as part of the
trusted boot. For more information on creating and loading existing
trusted/encrypted keys, refer to Documentation/keys-trusted-encrypted.txt. A
sample dracut patch, which loads the trusted/encrypted key and enables EVM, is
available from http://linux-ima.sourceforge.net/#EVM.
Based on the LSMs enabled, the set of EVM protected security xattrs is defined
at compile. EVM adds the following three calls to the existing security hooks:
evm_inode_setxattr(), evm_inode_post_setxattr(), and evm_inode_removexattr. To
initialize and update the 'security.evm' extended attribute, EVM defines three
calls: evm_inode_post_init(), evm_inode_post_setattr() and
evm_inode_post_removexattr() hooks. To verify the integrity of a security
xattr, EVM exports evm_verifyxattr().
Changelog v7:
- Fixed URL in EVM ABI documentation
Changelog v6: (based on Serge Hallyn's review)
- fix URL in patch description
- remove evm_hmac_size definition
- use SHA1_DIGEST_SIZE (removed both MAX_DIGEST_SIZE and evm_hmac_size)
- moved linux include before other includes
- test for crypto_hash_setkey failure
- fail earlier for invalid key
- clear entire encrypted key, even on failure
- check xattr name length before comparing xattr names
Changelog:
- locking based on i_mutex, remove evm_mutex
- using trusted/encrypted keys for storing the EVM key used in the HMAC-sha1
operation.
- replaced crypto hash with shash (Dmitry Kasatkin)
- support for additional methods of verifying the security xattrs
(Dmitry Kasatkin)
- iint not allocated for all regular files, but only for those appraised
- Use cap_sys_admin in lieu of cap_mac_admin
- Use __vfs_setxattr_noperm(), without permission checks, from EVM
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
2011-03-15 14:12:09 -06:00
|
|
|
config EVM
|
2014-12-20 13:41:11 -07:00
|
|
|
bool "EVM support"
|
2014-02-28 05:18:09 -07:00
|
|
|
select KEYS
|
|
|
|
select ENCRYPTED_KEYS
|
evm: re-release
EVM protects a file's security extended attributes(xattrs) against integrity
attacks. This patchset provides the framework and an initial method. The
initial method maintains an HMAC-sha1 value across the security extended
attributes, storing the HMAC value as the extended attribute 'security.evm'.
Other methods of validating the integrity of a file's metadata will be posted
separately (eg. EVM-digital-signatures).
While this patchset does authenticate the security xattrs, and
cryptographically binds them to the inode, coming extensions will bind other
directory and inode metadata for more complete protection. To help simplify
the review and upstreaming process, each extension will be posted separately
(eg. IMA-appraisal, IMA-appraisal-directory). For a general overview of the
proposed Linux integrity subsystem, refer to Dave Safford's whitepaper:
http://downloads.sf.net/project/linux-ima/linux-ima/Integrity_overview.pdf.
EVM depends on the Kernel Key Retention System to provide it with a
trusted/encrypted key for the HMAC-sha1 operation. The key is loaded onto the
root's keyring using keyctl. Until EVM receives notification that the key has
been successfully loaded onto the keyring (echo 1 > <securityfs>/evm), EVM can
not create or validate the 'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
Loading the key and signaling EVM should be done as early as possible. Normally
this is done in the initramfs, which has already been measured as part of the
trusted boot. For more information on creating and loading existing
trusted/encrypted keys, refer to Documentation/keys-trusted-encrypted.txt. A
sample dracut patch, which loads the trusted/encrypted key and enables EVM, is
available from http://linux-ima.sourceforge.net/#EVM.
Based on the LSMs enabled, the set of EVM protected security xattrs is defined
at compile. EVM adds the following three calls to the existing security hooks:
evm_inode_setxattr(), evm_inode_post_setxattr(), and evm_inode_removexattr. To
initialize and update the 'security.evm' extended attribute, EVM defines three
calls: evm_inode_post_init(), evm_inode_post_setattr() and
evm_inode_post_removexattr() hooks. To verify the integrity of a security
xattr, EVM exports evm_verifyxattr().
Changelog v7:
- Fixed URL in EVM ABI documentation
Changelog v6: (based on Serge Hallyn's review)
- fix URL in patch description
- remove evm_hmac_size definition
- use SHA1_DIGEST_SIZE (removed both MAX_DIGEST_SIZE and evm_hmac_size)
- moved linux include before other includes
- test for crypto_hash_setkey failure
- fail earlier for invalid key
- clear entire encrypted key, even on failure
- check xattr name length before comparing xattr names
Changelog:
- locking based on i_mutex, remove evm_mutex
- using trusted/encrypted keys for storing the EVM key used in the HMAC-sha1
operation.
- replaced crypto hash with shash (Dmitry Kasatkin)
- support for additional methods of verifying the security xattrs
(Dmitry Kasatkin)
- iint not allocated for all regular files, but only for those appraised
- Use cap_sys_admin in lieu of cap_mac_admin
- Use __vfs_setxattr_noperm(), without permission checks, from EVM
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
2011-03-15 14:12:09 -06:00
|
|
|
select CRYPTO_HMAC
|
|
|
|
select CRYPTO_SHA1
|
2018-06-08 15:57:43 -06:00
|
|
|
select CRYPTO_HASH_INFO
|
evm: re-release
EVM protects a file's security extended attributes(xattrs) against integrity
attacks. This patchset provides the framework and an initial method. The
initial method maintains an HMAC-sha1 value across the security extended
attributes, storing the HMAC value as the extended attribute 'security.evm'.
Other methods of validating the integrity of a file's metadata will be posted
separately (eg. EVM-digital-signatures).
While this patchset does authenticate the security xattrs, and
cryptographically binds them to the inode, coming extensions will bind other
directory and inode metadata for more complete protection. To help simplify
the review and upstreaming process, each extension will be posted separately
(eg. IMA-appraisal, IMA-appraisal-directory). For a general overview of the
proposed Linux integrity subsystem, refer to Dave Safford's whitepaper:
http://downloads.sf.net/project/linux-ima/linux-ima/Integrity_overview.pdf.
EVM depends on the Kernel Key Retention System to provide it with a
trusted/encrypted key for the HMAC-sha1 operation. The key is loaded onto the
root's keyring using keyctl. Until EVM receives notification that the key has
been successfully loaded onto the keyring (echo 1 > <securityfs>/evm), EVM can
not create or validate the 'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
Loading the key and signaling EVM should be done as early as possible. Normally
this is done in the initramfs, which has already been measured as part of the
trusted boot. For more information on creating and loading existing
trusted/encrypted keys, refer to Documentation/keys-trusted-encrypted.txt. A
sample dracut patch, which loads the trusted/encrypted key and enables EVM, is
available from http://linux-ima.sourceforge.net/#EVM.
Based on the LSMs enabled, the set of EVM protected security xattrs is defined
at compile. EVM adds the following three calls to the existing security hooks:
evm_inode_setxattr(), evm_inode_post_setxattr(), and evm_inode_removexattr. To
initialize and update the 'security.evm' extended attribute, EVM defines three
calls: evm_inode_post_init(), evm_inode_post_setattr() and
evm_inode_post_removexattr() hooks. To verify the integrity of a security
xattr, EVM exports evm_verifyxattr().
Changelog v7:
- Fixed URL in EVM ABI documentation
Changelog v6: (based on Serge Hallyn's review)
- fix URL in patch description
- remove evm_hmac_size definition
- use SHA1_DIGEST_SIZE (removed both MAX_DIGEST_SIZE and evm_hmac_size)
- moved linux include before other includes
- test for crypto_hash_setkey failure
- fail earlier for invalid key
- clear entire encrypted key, even on failure
- check xattr name length before comparing xattr names
Changelog:
- locking based on i_mutex, remove evm_mutex
- using trusted/encrypted keys for storing the EVM key used in the HMAC-sha1
operation.
- replaced crypto hash with shash (Dmitry Kasatkin)
- support for additional methods of verifying the security xattrs
(Dmitry Kasatkin)
- iint not allocated for all regular files, but only for those appraised
- Use cap_sys_admin in lieu of cap_mac_admin
- Use __vfs_setxattr_noperm(), without permission checks, from EVM
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
2011-03-15 14:12:09 -06:00
|
|
|
default n
|
|
|
|
help
|
|
|
|
EVM protects a file's security extended attributes against
|
|
|
|
integrity attacks.
|
|
|
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
2012-09-10 01:37:20 -06:00
|
|
|
|
2014-03-28 06:31:04 -06:00
|
|
|
config EVM_ATTR_FSUUID
|
|
|
|
bool "FSUUID (version 2)"
|
|
|
|
default y
|
2012-09-10 01:37:20 -06:00
|
|
|
depends on EVM
|
|
|
|
help
|
2014-03-28 06:31:04 -06:00
|
|
|
Include filesystem UUID for HMAC calculation.
|
|
|
|
|
|
|
|
Default value is 'selected', which is former version 2.
|
|
|
|
if 'not selected', it is former version 1
|
2012-09-10 01:37:20 -06:00
|
|
|
|
2014-03-28 06:31:04 -06:00
|
|
|
WARNING: changing the HMAC calculation method or adding
|
2012-09-10 01:37:20 -06:00
|
|
|
additional info to the calculation, requires existing EVM
|
2014-03-28 06:31:04 -06:00
|
|
|
labeled file systems to be relabeled.
|
|
|
|
|
2014-03-28 06:31:14 -06:00
|
|
|
config EVM_EXTRA_SMACK_XATTRS
|
|
|
|
bool "Additional SMACK xattrs"
|
|
|
|
depends on EVM && SECURITY_SMACK
|
|
|
|
default n
|
|
|
|
help
|
|
|
|
Include additional SMACK xattrs for HMAC calculation.
|
|
|
|
|
|
|
|
In addition to the original security xattrs (eg. security.selinux,
|
|
|
|
security.SMACK64, security.capability, and security.ima) included
|
|
|
|
in the HMAC calculation, enabling this option includes newly defined
|
|
|
|
Smack xattrs: security.SMACK64EXEC, security.SMACK64TRANSMUTE and
|
|
|
|
security.SMACK64MMAP.
|
|
|
|
|
|
|
|
WARNING: changing the HMAC calculation method or adding
|
|
|
|
additional info to the calculation, requires existing EVM
|
|
|
|
labeled file systems to be relabeled.
|
|
|
|
|
2018-05-15 11:38:26 -06:00
|
|
|
config EVM_ADD_XATTRS
|
|
|
|
bool "Add additional EVM extended attributes at runtime"
|
|
|
|
depends on EVM
|
|
|
|
default n
|
|
|
|
help
|
|
|
|
Allow userland to provide additional xattrs for HMAC calculation.
|
|
|
|
|
|
|
|
When this option is enabled, root can add additional xattrs to the
|
|
|
|
list used by EVM by writing them into
|
|
|
|
/sys/kernel/security/integrity/evm/evm_xattrs.
|
|
|
|
|
2015-10-22 12:26:21 -06:00
|
|
|
config EVM_LOAD_X509
|
|
|
|
bool "Load an X509 certificate onto the '.evm' trusted keyring"
|
2015-11-27 06:52:33 -07:00
|
|
|
depends on EVM && INTEGRITY_TRUSTED_KEYRING
|
2015-10-22 12:26:21 -06:00
|
|
|
default n
|
|
|
|
help
|
|
|
|
Load an X509 certificate onto the '.evm' trusted keyring.
|
|
|
|
|
|
|
|
This option enables X509 certificate loading from the kernel
|
|
|
|
onto the '.evm' trusted keyring. A public key can be used to
|
|
|
|
verify EVM integrity starting from the 'init' process.
|
|
|
|
|
|
|
|
config EVM_X509_PATH
|
|
|
|
string "EVM X509 certificate path"
|
|
|
|
depends on EVM_LOAD_X509
|
|
|
|
default "/etc/keys/x509_evm.der"
|
|
|
|
help
|
|
|
|
This option defines X509 certificate path.
|