Using Integrity Measurement Architecture in Gentoo

Finally, reboot with ima_appraise=enforce. The system should now run with appraisal enabled, causing the system to validate the hash against the stored -value before using it. If it doesn't match, then the file is not loaded. If it +value before using it. If it doesn't match, then the file is not loaded and any +access towards it will be denied with a Permission denied error. If it does match, and afterwards the file is modified, then the new hash is stored as extended attribute.

+How do I load in my own, custom IMA policy? + + +

+You can load in an IMA policy by cat'ing it into +/sys/kernel/security/ima/policy. If the policy is accepted, then +the command will succeed and the policy (pseudo)file will disappear +(this is by design, so that malicious users cannot alter the policy once +loaded). +

+ +

+Below is an example custom policy, taken from the default one with one addition: +ask it not to measure and appraise log files (through the use of the SELinux +logfile attribute). +

+ +

+# Magics can be found in kernel/include/uapi/linux/magic.h
+# Default can be found in security/integrity/ima/ima_policy.c
+# PROC_SUPER_MAGIC = 0x9fa0
+dont_measure fsmagic=0x9fa0
+dont_appraise fsmagic=0x9fa0
+# SYSFS_MAGIC = 0x62656572
+dont_measure fsmagic=0x62656572
+dont_appraise fsmagic=0x62656572
+# DEBUGFS_MAGIC = 0x64626720
+dont_measure fsmagic=0x64626720
+dont_appraise fsmagic=0x64626720
+# TMPFS_MAGIC = 0x01021994
+dont_measure fsmagic=0x01021994
+dont_appraise fsmagic=0x01021994
+# RAMFS_MAGIC = 0x858458f6
+dont_measure fsmagic=0x858458f6
+dont_appraise fsmagic=0x858458f6
+# DEVPTS_SUPER_MAGIC = 0x1cd1
+dont_measure fsmagic=0x1cd1
+dont_appraise fsmagic=0x1cd1
+# BINFMTFS_MAGIC = 0x42494e4d
+dont_measure fsmagic=0x42494e4d
+dont_appraise fsmagic=0x42494e4d
+# SECURITYFS_MAGIC = 0x73636673
+dont_measure fsmagic=0x73636673
+dont_appraise fsmagic=0x73636673
+# SELINUX_MAGIC = 0xf97cff8c
+dont_measure fsmagic=0xf97cff8c
+dont_appraise fsmagic=0xf97cff8c
+# CGROUP_SUPER_MAGIC = 0x27e0eb
+dont_appraise fsmagic=0x27e0eb
+# Do not measure all types that have the "logfile" SELinux attribute
+dont_measure obj_type=logfile
+dont_appraise obj_type=logfile
+# Remainder of the defaults
+measure func=FILE_MMAP mask=MAY_EXEC
+measure func=BPRM_CHECK mask=MAY_EXEC
+measure func=FILE_CHECK mask=MAY_READ uid=0
+appraise fowner=0
+

+ +

+Make sure no empty lines are in the policy; if not, it will be refused. You can +check the output of dmesg for hints why the policy was refused (it shows +what was accepted, so the next line would be a not-accepted line), or the audit +logs (but you will need to have auditd running) if you get lines such as +audit_printk_skb: XX callbacks suppressed as you then might not have all +the information you need. +

+ + +