2009-02-04 14:06:58 +00:00
|
|
|
# IBM Integrity Measurement Architecture
|
|
|
|
|
#
|
|
|
|
|
config IMA
|
|
|
|
|
bool "Integrity Measurement Architecture(IMA)"
|
|
|
|
|
select SECURITYFS
|
|
|
|
|
select CRYPTO
|
|
|
|
|
select CRYPTO_HMAC
|
|
|
|
|
select CRYPTO_MD5
|
|
|
|
|
select CRYPTO_SHA1
|
2013-04-25 07:43:56 +00:00
|
|
|
select CRYPTO_HASH_INFO
|
2012-01-05 14:49:54 +00:00
|
|
|
select TCG_TPM if HAS_IOMEM && !UML
|
2012-02-24 19:28:05 +00:00
|
|
|
select TCG_TIS if TCG_TPM && X86
|
2014-12-03 06:04:50 +00:00
|
|
|
select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES
|
2009-02-04 14:06:58 +00:00
|
|
|
help
|
|
|
|
|
The Trusted Computing Group(TCG) runtime Integrity
|
|
|
|
|
Measurement Architecture(IMA) maintains a list of hash
|
|
|
|
|
values of executables and other sensitive system files,
|
|
|
|
|
as they are read or executed. If an attacker manages
|
|
|
|
|
to change the contents of an important system file
|
|
|
|
|
being measured, we can tell.
|
|
|
|
|
|
|
|
|
|
If your system has a TPM chip, then IMA also maintains
|
|
|
|
|
an aggregate integrity value over this list inside the
|
|
|
|
|
TPM hardware, so that the TPM can prove to a third party
|
|
|
|
|
whether or not critical system files have been modified.
|
|
|
|
|
Read <http://www.usenix.org/events/sec04/tech/sailer.html>
|
|
|
|
|
to learn more about IMA.
|
|
|
|
|
If unsure, say N.
|
|
|
|
|
|
|
|
|
|
config IMA_MEASURE_PCR_IDX
|
|
|
|
|
int
|
|
|
|
|
depends on IMA
|
|
|
|
|
range 8 14
|
|
|
|
|
default 10
|
|
|
|
|
help
|
|
|
|
|
IMA_MEASURE_PCR_IDX determines the TPM PCR register index
|
|
|
|
|
that IMA uses to maintain the integrity aggregate of the
|
|
|
|
|
measurement list. If unsure, use the default 10.
|
|
|
|
|
|
2009-02-04 14:07:00 +00:00
|
|
|
config IMA_LSM_RULES
|
|
|
|
|
bool
|
2009-02-12 17:54:14 +00:00
|
|
|
depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK)
|
2009-02-04 14:07:00 +00:00
|
|
|
default y
|
|
|
|
|
help
|
2009-02-12 17:54:14 +00:00
|
|
|
Disabling this option will disregard LSM based policy rules.
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 15:15:05 +00:00
|
|
|
|
2013-06-07 10:16:34 +00:00
|
|
|
choice
|
|
|
|
|
prompt "Default template"
|
|
|
|
|
default IMA_NG_TEMPLATE
|
|
|
|
|
depends on IMA
|
|
|
|
|
help
|
|
|
|
|
Select the default IMA measurement template.
|
|
|
|
|
|
|
|
|
|
The original 'ima' measurement list template contains a
|
|
|
|
|
hash, defined as 20 bytes, and a null terminated pathname,
|
|
|
|
|
limited to 255 characters. The 'ima-ng' measurement list
|
|
|
|
|
template permits both larger hash digests and longer
|
|
|
|
|
pathnames.
|
|
|
|
|
|
|
|
|
|
config IMA_TEMPLATE
|
|
|
|
|
bool "ima"
|
|
|
|
|
config IMA_NG_TEMPLATE
|
|
|
|
|
bool "ima-ng (default)"
|
2013-07-23 15:15:00 +00:00
|
|
|
config IMA_SIG_TEMPLATE
|
|
|
|
|
bool "ima-sig"
|
2013-06-07 10:16:34 +00:00
|
|
|
endchoice
|
|
|
|
|
|
|
|
|
|
config IMA_DEFAULT_TEMPLATE
|
|
|
|
|
string
|
|
|
|
|
depends on IMA
|
|
|
|
|
default "ima" if IMA_TEMPLATE
|
|
|
|
|
default "ima-ng" if IMA_NG_TEMPLATE
|
2013-07-23 15:15:00 +00:00
|
|
|
default "ima-sig" if IMA_SIG_TEMPLATE
|
2013-06-07 10:16:34 +00:00
|
|
|
|
2013-06-07 10:16:37 +00:00
|
|
|
choice
|
|
|
|
|
prompt "Default integrity hash algorithm"
|
|
|
|
|
default IMA_DEFAULT_HASH_SHA1
|
|
|
|
|
depends on IMA
|
|
|
|
|
help
|
|
|
|
|
Select the default hash algorithm used for the measurement
|
|
|
|
|
list, integrity appraisal and audit log. The compiled default
|
|
|
|
|
hash algorithm can be overwritten using the kernel command
|
|
|
|
|
line 'ima_hash=' option.
|
|
|
|
|
|
|
|
|
|
config IMA_DEFAULT_HASH_SHA1
|
|
|
|
|
bool "SHA1 (default)"
|
|
|
|
|
depends on CRYPTO_SHA1
|
|
|
|
|
|
|
|
|
|
config IMA_DEFAULT_HASH_SHA256
|
|
|
|
|
bool "SHA256"
|
|
|
|
|
depends on CRYPTO_SHA256 && !IMA_TEMPLATE
|
|
|
|
|
|
|
|
|
|
config IMA_DEFAULT_HASH_SHA512
|
|
|
|
|
bool "SHA512"
|
|
|
|
|
depends on CRYPTO_SHA512 && !IMA_TEMPLATE
|
|
|
|
|
|
|
|
|
|
config IMA_DEFAULT_HASH_WP512
|
|
|
|
|
bool "WP512"
|
|
|
|
|
depends on CRYPTO_WP512 && !IMA_TEMPLATE
|
|
|
|
|
endchoice
|
|
|
|
|
|
|
|
|
|
config IMA_DEFAULT_HASH
|
|
|
|
|
string
|
|
|
|
|
depends on IMA
|
|
|
|
|
default "sha1" if IMA_DEFAULT_HASH_SHA1
|
|
|
|
|
default "sha256" if IMA_DEFAULT_HASH_SHA256
|
|
|
|
|
default "sha512" if IMA_DEFAULT_HASH_SHA512
|
|
|
|
|
default "wp512" if IMA_DEFAULT_HASH_WP512
|
|
|
|
|
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 15:15:05 +00:00
|
|
|
config IMA_APPRAISE
|
|
|
|
|
bool "Appraise integrity measurements"
|
|
|
|
|
depends on IMA
|
|
|
|
|
default n
|
|
|
|
|
help
|
|
|
|
|
This option enables local measurement integrity appraisal.
|
|
|
|
|
It requires the system to be labeled with a security extended
|
|
|
|
|
attribute containing the file hash measurement. To protect
|
|
|
|
|
the security extended attributes from offline attack, enable
|
|
|
|
|
and configure EVM.
|
|
|
|
|
|
|
|
|
|
For more information on integrity appraisal refer to:
|
|
|
|
|
<http://linux-ima.sourceforge.net>
|
|
|
|
|
If unsure, say N.
|
2013-08-13 12:47:43 +00:00
|
|
|
|
|
|
|
|
config IMA_TRUSTED_KEYRING
|
|
|
|
|
bool "Require all keys on the .ima keyring be signed"
|
|
|
|
|
depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
|
|
|
|
|
depends on INTEGRITY_ASYMMETRIC_KEYS
|
|
|
|
|
default y
|
|
|
|
|
help
|
|
|
|
|
This option requires that all keys added to the .ima
|
|
|
|
|
keyring be signed by a key on the system trusted keyring.
|
2014-11-05 15:01:14 +00:00
|
|
|
|
|
|
|
|
config IMA_LOAD_X509
|
|
|
|
|
bool "Load X509 certificate onto the '.ima' trusted keyring"
|
|
|
|
|
depends on IMA_TRUSTED_KEYRING
|
|
|
|
|
default n
|
|
|
|
|
help
|
|
|
|
|
File signature verification is based on the public keys
|
|
|
|
|
loaded on the .ima trusted keyring. These public keys are
|
|
|
|
|
X509 certificates signed by a trusted key on the
|
|
|
|
|
.system keyring. This option enables X509 certificate
|
|
|
|
|
loading from the kernel onto the '.ima' trusted keyring.
|
|
|
|
|
|
|
|
|
|
config IMA_X509_PATH
|
|
|
|
|
string "IMA X509 certificate path"
|
|
|
|
|
depends on IMA_LOAD_X509
|
|
|
|
|
default "/etc/keys/x509_ima.der"
|
|
|
|
|
help
|
|
|
|
|
This option defines IMA X509 certificate path.
|
2014-11-05 15:01:16 +00:00
|
|
|
|
|
|
|
|
config IMA_APPRAISE_SIGNED_INIT
|
|
|
|
|
bool "Require signed user-space initialization"
|
|
|
|
|
depends on IMA_LOAD_X509
|
|
|
|
|
default n
|
|
|
|
|
help
|
|
|
|
|
This option requires user-space init to be signed.
|
