Re: [Linux-ima-user] Bypass IMA

[Seiji M. <sei...@gm...>]

Hi Till,

This is sharpshooting.:-)

2007/3/1, Till Bentz <ti...@on...>:
> I install IMA and the boot loader and everything right. I run the machine
> and I get my ML. I make a copy of this list. Now I reboot, and turn IMA off.
> My IMA PCR, let it be PCR 10, is now empty. I can fill it with the list and
> pretend, that that's what IMA measured. Now I can "testify" that my machine
> runs only valid programs. I can quote the PCR10-Value as a proof and trick
> the remote challenger. The nonce is no problem either because I can just add
> it.
>
> Please, someone, point out my error in thinking :)

To trust the ML, you have to validate the kernel with ima in the proper way.
So just measuring the digest of kernel image in bootloader is not enough.
You have to measure the kernel command line option too.

If the kernel commandline was measured in PCR8, we can "testify"  this
difference by quoting PCR0-7,8,10 values.

That's certainly the case with attesting the SecureOS capability. e.g. selinux=0
We have to design a Transitive Trust Chain carefully.

regards,
--
Seiji