1*4882a593SmuzhiyunWhat: security/ima/policy 2*4882a593SmuzhiyunDate: May 2008 3*4882a593SmuzhiyunContact: Mimi Zohar <zohar@us.ibm.com> 4*4882a593SmuzhiyunDescription: 5*4882a593Smuzhiyun The Trusted Computing Group(TCG) runtime Integrity 6*4882a593Smuzhiyun Measurement Architecture(IMA) maintains a list of hash 7*4882a593Smuzhiyun values of executables and other sensitive system files 8*4882a593Smuzhiyun loaded into the run-time of this system. At runtime, 9*4882a593Smuzhiyun the policy can be constrained based on LSM specific data. 10*4882a593Smuzhiyun Policies are loaded into the securityfs file ima/policy 11*4882a593Smuzhiyun by opening the file, writing the rules one at a time and 12*4882a593Smuzhiyun then closing the file. The new policy takes effect after 13*4882a593Smuzhiyun the file ima/policy is closed. 14*4882a593Smuzhiyun 15*4882a593Smuzhiyun IMA appraisal, if configured, uses these file measurements 16*4882a593Smuzhiyun for local measurement appraisal. 17*4882a593Smuzhiyun 18*4882a593Smuzhiyun :: 19*4882a593Smuzhiyun 20*4882a593Smuzhiyun rule format: action [condition ...] 21*4882a593Smuzhiyun 22*4882a593Smuzhiyun action: measure | dont_measure | appraise | dont_appraise | 23*4882a593Smuzhiyun audit | hash | dont_hash 24*4882a593Smuzhiyun condition:= base | lsm [option] 25*4882a593Smuzhiyun base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=] 26*4882a593Smuzhiyun [euid=] [fowner=] [fsname=]] 27*4882a593Smuzhiyun lsm: [[subj_user=] [subj_role=] [subj_type=] 28*4882a593Smuzhiyun [obj_user=] [obj_role=] [obj_type=]] 29*4882a593Smuzhiyun option: [[appraise_type=]] [template=] [permit_directio] 30*4882a593Smuzhiyun [appraise_flag=] [keyrings=] 31*4882a593Smuzhiyun base: 32*4882a593Smuzhiyun func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK]MODULE_CHECK] 33*4882a593Smuzhiyun [FIRMWARE_CHECK] 34*4882a593Smuzhiyun [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK] 35*4882a593Smuzhiyun [KEXEC_CMDLINE] [KEY_CHECK] 36*4882a593Smuzhiyun mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] 37*4882a593Smuzhiyun [[^]MAY_EXEC] 38*4882a593Smuzhiyun fsmagic:= hex value 39*4882a593Smuzhiyun fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6) 40*4882a593Smuzhiyun uid:= decimal value 41*4882a593Smuzhiyun euid:= decimal value 42*4882a593Smuzhiyun fowner:= decimal value 43*4882a593Smuzhiyun lsm: are LSM specific 44*4882a593Smuzhiyun option: 45*4882a593Smuzhiyun appraise_type:= [imasig] [imasig|modsig] 46*4882a593Smuzhiyun appraise_flag:= [check_blacklist] 47*4882a593Smuzhiyun Currently, blacklist check is only for files signed with appended 48*4882a593Smuzhiyun signature. 49*4882a593Smuzhiyun keyrings:= list of keyrings 50*4882a593Smuzhiyun (eg, .builtin_trusted_keys|.ima). Only valid 51*4882a593Smuzhiyun when action is "measure" and func is KEY_CHECK. 52*4882a593Smuzhiyun template:= name of a defined IMA template type 53*4882a593Smuzhiyun (eg, ima-ng). Only valid when action is "measure". 54*4882a593Smuzhiyun pcr:= decimal value 55*4882a593Smuzhiyun 56*4882a593Smuzhiyun default policy: 57*4882a593Smuzhiyun # PROC_SUPER_MAGIC 58*4882a593Smuzhiyun dont_measure fsmagic=0x9fa0 59*4882a593Smuzhiyun dont_appraise fsmagic=0x9fa0 60*4882a593Smuzhiyun # SYSFS_MAGIC 61*4882a593Smuzhiyun dont_measure fsmagic=0x62656572 62*4882a593Smuzhiyun dont_appraise fsmagic=0x62656572 63*4882a593Smuzhiyun # DEBUGFS_MAGIC 64*4882a593Smuzhiyun dont_measure fsmagic=0x64626720 65*4882a593Smuzhiyun dont_appraise fsmagic=0x64626720 66*4882a593Smuzhiyun # TMPFS_MAGIC 67*4882a593Smuzhiyun dont_measure fsmagic=0x01021994 68*4882a593Smuzhiyun dont_appraise fsmagic=0x01021994 69*4882a593Smuzhiyun # RAMFS_MAGIC 70*4882a593Smuzhiyun dont_appraise fsmagic=0x858458f6 71*4882a593Smuzhiyun # DEVPTS_SUPER_MAGIC 72*4882a593Smuzhiyun dont_measure fsmagic=0x1cd1 73*4882a593Smuzhiyun dont_appraise fsmagic=0x1cd1 74*4882a593Smuzhiyun # BINFMTFS_MAGIC 75*4882a593Smuzhiyun dont_measure fsmagic=0x42494e4d 76*4882a593Smuzhiyun dont_appraise fsmagic=0x42494e4d 77*4882a593Smuzhiyun # SECURITYFS_MAGIC 78*4882a593Smuzhiyun dont_measure fsmagic=0x73636673 79*4882a593Smuzhiyun dont_appraise fsmagic=0x73636673 80*4882a593Smuzhiyun # SELINUX_MAGIC 81*4882a593Smuzhiyun dont_measure fsmagic=0xf97cff8c 82*4882a593Smuzhiyun dont_appraise fsmagic=0xf97cff8c 83*4882a593Smuzhiyun # CGROUP_SUPER_MAGIC 84*4882a593Smuzhiyun dont_measure fsmagic=0x27e0eb 85*4882a593Smuzhiyun dont_appraise fsmagic=0x27e0eb 86*4882a593Smuzhiyun # NSFS_MAGIC 87*4882a593Smuzhiyun dont_measure fsmagic=0x6e736673 88*4882a593Smuzhiyun dont_appraise fsmagic=0x6e736673 89*4882a593Smuzhiyun 90*4882a593Smuzhiyun measure func=BPRM_CHECK 91*4882a593Smuzhiyun measure func=FILE_MMAP mask=MAY_EXEC 92*4882a593Smuzhiyun measure func=FILE_CHECK mask=MAY_READ uid=0 93*4882a593Smuzhiyun measure func=MODULE_CHECK 94*4882a593Smuzhiyun measure func=FIRMWARE_CHECK 95*4882a593Smuzhiyun appraise fowner=0 96*4882a593Smuzhiyun 97*4882a593Smuzhiyun The default policy measures all executables in bprm_check, 98*4882a593Smuzhiyun all files mmapped executable in file_mmap, and all files 99*4882a593Smuzhiyun open for read by root in do_filp_open. The default appraisal 100*4882a593Smuzhiyun policy appraises all files owned by root. 101*4882a593Smuzhiyun 102*4882a593Smuzhiyun Examples of LSM specific definitions: 103*4882a593Smuzhiyun 104*4882a593Smuzhiyun SELinux:: 105*4882a593Smuzhiyun 106*4882a593Smuzhiyun dont_measure obj_type=var_log_t 107*4882a593Smuzhiyun dont_appraise obj_type=var_log_t 108*4882a593Smuzhiyun dont_measure obj_type=auditd_log_t 109*4882a593Smuzhiyun dont_appraise obj_type=auditd_log_t 110*4882a593Smuzhiyun measure subj_user=system_u func=FILE_CHECK mask=MAY_READ 111*4882a593Smuzhiyun measure subj_role=system_r func=FILE_CHECK mask=MAY_READ 112*4882a593Smuzhiyun 113*4882a593Smuzhiyun Smack:: 114*4882a593Smuzhiyun 115*4882a593Smuzhiyun measure subj_user=_ func=FILE_CHECK mask=MAY_READ 116*4882a593Smuzhiyun 117*4882a593Smuzhiyun Example of measure rules using alternate PCRs:: 118*4882a593Smuzhiyun 119*4882a593Smuzhiyun measure func=KEXEC_KERNEL_CHECK pcr=4 120*4882a593Smuzhiyun measure func=KEXEC_INITRAMFS_CHECK pcr=5 121*4882a593Smuzhiyun 122*4882a593Smuzhiyun Example of appraise rule allowing modsig appended signatures: 123*4882a593Smuzhiyun 124*4882a593Smuzhiyun appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig 125*4882a593Smuzhiyun 126*4882a593Smuzhiyun Example of measure rule using KEY_CHECK to measure all keys: 127*4882a593Smuzhiyun 128*4882a593Smuzhiyun measure func=KEY_CHECK 129*4882a593Smuzhiyun 130*4882a593Smuzhiyun Example of measure rule using KEY_CHECK to only measure 131*4882a593Smuzhiyun keys added to .builtin_trusted_keys or .ima keyring: 132*4882a593Smuzhiyun 133*4882a593Smuzhiyun measure func=KEY_CHECK keyrings=.builtin_trusted_keys|.ima 134