Using Integrity Measurement Architecture in Gentoo

kernel /boot/vmlinuz root=/dev/vda1 ima_tcb -# Only if IMA appraisal patch is enabled: +# Only if IMA appraisal is wanted: kernel /boot/vmlinuz root=/dev/vda1 ima_tcb ima_appraise=enforce ima_appraise_tcb

-~# find / $ -fstype rootfs -o -fstype ext4 -a -type f $ -uid 0 -exec head -n 1 '{}' > /dev/null \; +~# find / $ -fstype rootfs -o -fstype ext4 $ -type -uid 0 -exec head -n 1 '{}' > /dev/null \;

-~# ima_id=`keyctl newring _ima @u` -~# evmctl import /path/to/rsa_public.pem $ima_id + + + + + +Asked Questions with Answers +

+How do I know IMA with appraisal is working? + + +

+This is as simple as finding a file that does not have its hash value stored as +an extended attribute while ima_appraise is in enforcing mode. +

+ +

+# getfattr -m . -d /etc/mtab
+getfattr: Removing leading '/' from absolute path names
+# file: etc/mtab
+security.selinux="system_u:object_r:etc_runtime_t"
+
+# cat /etc/mtab
+cat: /etc/mtab: Permission denied
+
+# dmesg | tail -1
+[  256.756465] type=1800 audit(1356637858.947:53): pid=3852 uid=0 auid=0 ses=2
+subj=root:sysadm_r:sysadm_t op="appraise_data" cause="missing-hash" comm="cat"
+name="/etc/mtab" dev="dm-2" ino=394144 res=0
+

+ +

+In the above example, the IMA subsystem reports that the /etc/mtab +file misses its hash value (which should be stored as security.ima) and +as such is denying the cat application access to it. +

+ +

+If you can miss the file (such as with /etc/mtab) you can remove it +and regenerate it if you wish: +

+ +

+# rm /etc/mtab
+# cat /proc/mounts > /etc/mtab
+# restorecon /etc/mtab # If using SELinux
+# evmctl ima_hash /etc/mtab
+# getfattr -m . -d /etc/mtab
+getfattr: Removing leading '/' from absolute path names
+# file: etc/mtab
+security.ima=0sAUlIU5ffoobWOh0FsSIbgh9Ac8YK
+security.selinux="root:object_r:etc_runtime_t"
+

+ + +

+I was able to edit an 'immutable' file and still run it. How come? + + +

+If you digitally signed a script using evmctl sign --imasig <file> +<private-key> and then edited the file with vim, then this +behavior is to be expected. vim removes the original file and replaces it +with a new one. The newly created file is given an appropriate hash (but no +digital signature of course) and thus you can still execute it. +

+ +

+The use of digital signatures is more for kernel modules and ELF binaries. But +below an example of how it does work - if you edit the file rather than replace +it. +

+ +

+# evmctl sign --imasig ./test.sh /root/rsa_private.pem
+# ./test.sh
+Hello World (again)
+# echo "echo \"And now...\"" >> test.sh 
+# ./test.sh
+bash: ./test.sh: Permission denied
+# cat test.sh
+cat: test.sh: Permission denied
+# dmesg | tail -2
+[  643.211490] type=1800 audit(1356639603.315:37): pid=3956 uid=0 auid=0 ses=3
+subj=root:sysadm_r:sysadm_t op="appraise_data" cause="invalid-signature"
+comm="bash" name="/bin/test.sh" dev="dm-2" ino=131466 res=0
+[  649.123917] type=1800 audit(1356639609.227:38): pid=3958 uid=0 auid=0 ses=3
+subj=root:sysadm_r:sysadm_t op="appraise_data" cause="invalid-signature"
+comm="cat" name="/bin/test.sh" dev="dm-2" ino=131466 res=0