Re: [Linux-ima-user] Looking for definition of ima behavior "importing" signatures and hashes.

[Curtis V. <cu...@vp...>]

That is a great help.  The odd behavior I've been seeing seems to be associated with using tar.  Tar with --xattrs will correctly collect all the security xattrs but restoring the xattrs Is almost always broken. Sometime depending on the policy and ima defaults I get different hashes or no hashes.  
It will not ever restore a signature.

I'll focus on using other tools and let you know if I see anything else that is unexpected.

Regards,
Curtis

-----Original Message-----
From: Mimi Zohar [mailto:zo...@li...] 
Sent: Tuesday, June 16, 2015 10:34 AM
To: Curtis Veit
Cc: lin...@li...
Subject: Re: [Linux-ima-user] Looking for definition of ima behavior "importing" signatures and hashes.

On Tue, 2015-06-16 at 13:57 +0000, Curtis Veit wrote:
> I've mentioned seeing odd behavior copying hashes and signatures using rsync and tar.
> Is there documentation anywhere describing the expected behavior?
> 
> A couple examples. I just switched kernels from my own with ima-sig and hashes=sha256 built in to a standard
> Ubuntu kernel and now all hashes and signatures get changes automatically to sha1.   I guess this should be expected but was a surprise in a way. (Apparently Ubuntu is shipping a kernel that defaults to sha1)
> 
> Things that seem to affect the behavior creating the hash or signature.
> 
> IMA kernel Mode: ima ima-ng or ima-sig IMA hash default: sha1 sha256, 
> sha512 (Can anyone tell me what the kernel command line arguments are 
> for these two items?)

The "ima_hash=" specifies the default hash algorithm used in the IMA
measurement list.   In order to prevent hashing the file once for the
measurement list and again for appraisal, the same hash algorithm is used for both.  The hash algorithm in the xattr will also appear in the measurement list.

> IMA can also be in a state where the xattrs are simply dropped when the copy is done.
> (Can anyone point me to an explanation of conditions that must be met 
> for the xattr to be retained?)

When using 'cp', specify "--preserve=xattrs" to copy the security xattrs.
 
> This may be related to the policy that is currently in force.  And 
> seems to work when in either fix or Enforcing mode.

True, but "fix" mode should only be used for initial labeling of the
filesystem.   After that, on file close, if the file has been modified
and is in policy, the file hash will be updated.  To detect file
modification, the file system needs to be mounted with iversion.   

> There are times I think I should be in enforcing mode but hashes are 
> dropped. I am not certain if it is because I am not actually in enforcing mode or because the policy I loaded is bad.
> Is there a definition for how policy settings affect the restoration 
> of IMA xattrs when copying with tar or rsync?

I haven't looked at rsync.  As for tar, I opened a bug March 2014, but never heard back - http://lists.gnu.org/archive/html/bug-tar/2014-03/msg00029.html.  I haven't tried this patch recently.

Mimi

> Any help on this would be profoundly appreciated!  (pointer to docs 
> and/or the place the code implements the behavior or specific explanations would be very helpful.)