Re: [dm-devel] [RFC PATCH v5 00/11] Integrity Policy Enforcement LSM (IPE)

> On Aug 12, 2020, at 11:42 AM, James Bottomley <James.Bottomley@Hans > enPartnership.com> wrote:

> For most people the security mechanism of local xattrs is > sufficient. If you're paranoid, you don't believe it is and you > use EVM. When IMA metadata happens to be stored in local filesystems in a trusted xattr, it's going to enjoy the protection you describe without needing the addition of a cryptographic signature. However, that metadata doesn't live its whole life there. It can reside in a tar file, it can cross a network, it can live on a back-up tape. I think we agree that any time that metadata is in transit or at rest outside of a Linux local filesystem, it is exposed. Thus I'm interested in a metadata protection mechanism that does not rely on the security characteristics of a particular storage container. For me, a cryptographic signature fits that bill nicely.

> > > I think Mimi's other point is actually that IMA uses a flat > > > hash which we derive by reading the entire file and then > > > watching for mutations. Since you cannot guarantee we get > > > notice of mutation with NFS, the entire IMA mechanism can't > > > really be applied in its current form and we have to resort to > > > chunk at a time verifications that a Merkel tree would provide. > > > > I'm not sure what you mean by this. An NFS client relies on > > notification of mutation to maintain the integrity of its cache > > of NFS file content, and it's done that since the 1980s. > > Mutation detection is part of the current IMA security model. If > IMA sees a file mutate it has to be rehashed the next time it > passes the gate. If we can't trust the NFS server, we can't trust > the NFS mutation notification and we have to have a different > mechanism to check the file. When an NFS server lies about mtime and ctime, then NFS is completely broken. Untrusted NFS server doesn't mean "broken behavior" -- I would think that local filesystems will have the same problem if they can't trust a local block device to store filesystem metadata like indirect blocks and timestamps. It's not clear to me that IMA as currently implemented can protect against broken storage devices or incorrect filesystem behavior.

> > In addition to examining a file's mtime and ctime as maintained > > by the NFS server, a client can rely on the file's NFSv4 change > > attribute or an NFSv4 delegation. > > And that's secure in the face of a malicious or compromised server? > > The bottom line is still, I think we can't use linear hashes with > an open/exec/mmap gate with NFS and we have to move to chunk at a > time verification like that provided by a merkel tree. That's fine until we claim that remote filesystems require one form of metadata and local filesystems use some other form. To guarantee an unbroken chain of provenance, everyone has to use the same portable metadata format that is signed once by the content creator. That's essentially why I believe the Merkle-based metadata format must require that the tree root is signed.