Re: [PATCH v5 5/8] ima: permit fsverity's file digests in the IMA measurement list

[Eric Biggers]

On Fri, Feb 11, 2022 at 04:43:07PM -0500, Mimi Zohar wrote:
> diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
> index 839fab811b18..ff3c906738cb 100644
> --- a/Documentation/ABI/testing/ima_policy
> +++ b/Documentation/ABI/testing/ima_policy
> @@ -51,6 +51,9 @@ Description:
>  			appraise_flag:= [check_blacklist]
>  			Currently, blacklist check is only for files signed with appended
>  			signature.
> +			digest_type:= verity
> +			    Require fs-verity's file digest instead of the
> +			    regular IMA file hash.
>  			keyrings:= list of keyrings
>  			(eg, .builtin_trusted_keys|.ima). Only valid
>  			when action is "measure" and func is KEY_CHECK.
> @@ -149,3 +152,10 @@ Description:
>  		security.ima xattr of a file:
>  
>  			appraise func=SETXATTR_CHECK appraise_algos=sha256,sha384,sha512
> +
> +		Example of 'measure' rule requiring fs-verity's digests on a
> +		particular filesystem with indication of type of digest in
> +		the measurement list.
> +
> +			measure func=FILE_CHECK digest_type=verity \
> +				fsuuid=... template=ima-ngv2
> diff --git a/Documentation/security/IMA-templates.rst b/Documentation/security/IMA-templates.rst
> index 1a91d92950a7..1e3fe986764e 100644
> --- a/Documentation/security/IMA-templates.rst
> +++ b/Documentation/security/IMA-templates.rst
> @@ -69,6 +69,8 @@ descriptors by adding their identifier to the format string
>     algorithm (field format: [<hash algo>:]digest, where the digest
>     prefix is shown only if the hash algorithm is not SHA1 or MD5);
>   - 'd-modsig': the digest of the event without the appended modsig;
> + - 'd-type': differentiate between fs-verity's Merkle tree based file hash
> +   from a regular IMA file hash measurement.
>   - 'n-ng': the name of the event, without size limitations;
>   - 'sig': the file signature, or the EVM portable signature if the file
>     signature is not found;
> @@ -106,3 +108,8 @@ currently the following methods are supported:
>     the ``ima_template=`` parameter;
>   - register a new template descriptor with custom format through the kernel
>     command line parameter ``ima_template_fmt=``.

Is there more IMA documentation elsewhere, or is this everything?  These files
are hard to follow.

> diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
> index daf49894fd7d..39a999877013 100644
> --- a/security/integrity/integrity.h
> +++ b/security/integrity/integrity.h
> @@ -32,7 +32,7 @@
>  #define IMA_HASHED		0x00000200
>  
>  /* iint policy rule cache flags */
> -#define IMA_NONACTION_FLAGS	0xff000000
> +#define IMA_NONACTION_FLAGS	0xff800000
>  #define IMA_DIGSIG_REQUIRED	0x01000000
>  #define IMA_PERMIT_DIRECTIO	0x02000000
>  #define IMA_NEW_FILE		0x04000000
> @@ -40,6 +40,8 @@
>  #define IMA_FAIL_UNVERIFIABLE_SIGS	0x10000000
>  #define IMA_MODSIG_ALLOWED	0x20000000
>  #define IMA_CHECK_BLACKLIST	0x40000000
> +#define IMA_VERITY_REQUIRED	0x80000000
> +#define IMA_VERITY_DIGEST	0x00800000

How about defining these flags in numerical order?

- Eric