mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-26 06:04:14 +08:00
fa516b66a1
Sites may wish to provide additional metadata alongside files in order to make more fine-grained security decisions[1]. The security of this is enhanced if this metadata is protected, something that EVM makes possible. However, the kernel cannot know about the set of extended attributes that local admins may wish to protect, and hardcoding this policy in the kernel makes it difficult to change over time and less convenient for distributions to enable. This patch adds a new /sys/kernel/security/integrity/evm/evm_xattrs node, which can be read to obtain the current set of EVM-protected extended attributes or written to in order to add new entries. Extending this list will not change the validity of any existing signatures provided that the file in question does not have any of the additional extended attributes - missing xattrs are skipped when calculating the EVM hash. [1] For instance, a package manager could install information about the package uploader in an additional extended attribute. Local LSM policy could then be associated with that extended attribute in order to restrict the privileges available to packages from less trusted uploaders. Signed-off-by: Matthew Garrett <mjg59@google.com> Reviewed-by: James Morris <james.morris@microsoft.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
73 lines
2.2 KiB
Plaintext
73 lines
2.2 KiB
Plaintext
config EVM
|
|
bool "EVM support"
|
|
select KEYS
|
|
select ENCRYPTED_KEYS
|
|
select CRYPTO_HMAC
|
|
select CRYPTO_SHA1
|
|
default n
|
|
help
|
|
EVM protects a file's security extended attributes against
|
|
integrity attacks.
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config EVM_ATTR_FSUUID
|
|
bool "FSUUID (version 2)"
|
|
default y
|
|
depends on EVM
|
|
help
|
|
Include filesystem UUID for HMAC calculation.
|
|
|
|
Default value is 'selected', which is former version 2.
|
|
if 'not selected', it is former version 1
|
|
|
|
WARNING: changing the HMAC calculation method or adding
|
|
additional info to the calculation, requires existing EVM
|
|
labeled file systems to be relabeled.
|
|
|
|
config EVM_EXTRA_SMACK_XATTRS
|
|
bool "Additional SMACK xattrs"
|
|
depends on EVM && SECURITY_SMACK
|
|
default n
|
|
help
|
|
Include additional SMACK xattrs for HMAC calculation.
|
|
|
|
In addition to the original security xattrs (eg. security.selinux,
|
|
security.SMACK64, security.capability, and security.ima) included
|
|
in the HMAC calculation, enabling this option includes newly defined
|
|
Smack xattrs: security.SMACK64EXEC, security.SMACK64TRANSMUTE and
|
|
security.SMACK64MMAP.
|
|
|
|
WARNING: changing the HMAC calculation method or adding
|
|
additional info to the calculation, requires existing EVM
|
|
labeled file systems to be relabeled.
|
|
|
|
config EVM_ADD_XATTRS
|
|
bool "Add additional EVM extended attributes at runtime"
|
|
depends on EVM
|
|
default n
|
|
help
|
|
Allow userland to provide additional xattrs for HMAC calculation.
|
|
|
|
When this option is enabled, root can add additional xattrs to the
|
|
list used by EVM by writing them into
|
|
/sys/kernel/security/integrity/evm/evm_xattrs.
|
|
|
|
config EVM_LOAD_X509
|
|
bool "Load an X509 certificate onto the '.evm' trusted keyring"
|
|
depends on EVM && INTEGRITY_TRUSTED_KEYRING
|
|
default n
|
|
help
|
|
Load an X509 certificate onto the '.evm' trusted keyring.
|
|
|
|
This option enables X509 certificate loading from the kernel
|
|
onto the '.evm' trusted keyring. A public key can be used to
|
|
verify EVM integrity starting from the 'init' process.
|
|
|
|
config EVM_X509_PATH
|
|
string "EVM X509 certificate path"
|
|
depends on EVM_LOAD_X509
|
|
default "/etc/keys/x509_evm.der"
|
|
help
|
|
This option defines X509 certificate path.
|