forked from Minki/linux
ae1ba1676b
When EVM is enabled it forbids modification of metadata protected by EVM unless there is already a valid EVM signature. If any modification is made, the kernel will then generate a new EVM HMAC. However, this does not map well on use cases which use only asymmetric EVM signatures, as in this scenario the kernel is unable to generate new signatures. This patch extends the /sys/kernel/security/evm interface to allow userland to request that modification of these xattrs be permitted. This is only permitted if no keys have already been loaded. In this configuration, modifying the metadata will invalidate the EVM appraisal on the file in question. This allows packaging systems to write out new files, set the relevant extended attributes and then move them into place. There's also some refactoring of the use of evm_initialized in order to avoid heading down codepaths that assume there's a key available. Signed-off-by: Matthew Garrett <mjg59@google.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
60 lines
2.1 KiB
Plaintext
60 lines
2.1 KiB
Plaintext
What: security/evm
|
|
Date: March 2011
|
|
Contact: Mimi Zohar <zohar@us.ibm.com>
|
|
Description:
|
|
EVM protects a file's security extended attributes(xattrs)
|
|
against integrity attacks. The initial method maintains an
|
|
HMAC-sha1 value across the extended attributes, storing the
|
|
value as the extended attribute 'security.evm'.
|
|
|
|
EVM supports two classes of security.evm. The first is
|
|
an HMAC-sha1 generated locally with a
|
|
trusted/encrypted key stored in the Kernel Key
|
|
Retention System. The second is a digital signature
|
|
generated either locally or remotely using an
|
|
asymmetric key. These keys are loaded onto root's
|
|
keyring using keyctl, and EVM is then enabled by
|
|
echoing a value to <securityfs>/evm made up of the
|
|
following bits:
|
|
|
|
Bit Effect
|
|
0 Enable HMAC validation and creation
|
|
1 Enable digital signature validation
|
|
2 Permit modification of EVM-protected metadata at
|
|
runtime. Not supported if HMAC validation and
|
|
creation is enabled.
|
|
31 Disable further runtime modification of EVM policy
|
|
|
|
For example:
|
|
|
|
echo 1 ><securityfs>/evm
|
|
|
|
will enable HMAC validation and creation
|
|
|
|
echo 0x80000003 ><securityfs>/evm
|
|
|
|
will enable HMAC and digital signature validation and
|
|
HMAC creation and disable all further modification of policy.
|
|
|
|
echo 0x80000006 ><securityfs>/evm
|
|
|
|
will enable digital signature validation, permit
|
|
modification of EVM-protected metadata and
|
|
disable all further modification of policy
|
|
|
|
Note that once a key has been loaded, it will no longer be
|
|
possible to enable metadata modification.
|
|
|
|
Until key loading has been signaled EVM can not create
|
|
or validate the 'security.evm' xattr, but returns
|
|
INTEGRITY_UNKNOWN. Loading keys and signaling EVM
|
|
should be done as early as possible. Normally this is
|
|
done in the initramfs, which has already been measured
|
|
as part of the trusted boot. For more information on
|
|
creating and loading existing trusted/encrypted keys,
|
|
refer to:
|
|
Documentation/security/keys/trusted-encrypted.rst. Both
|
|
dracut (via 97masterkey and 98integrity) and systemd (via
|
|
core/ima-setup) have support for loading keys at boot
|
|
time.
|