#LINUX KERNEL EXTENDED ATTRIBUTE UPDATE#
#LINUX KERNEL EXTENDED ATTRIBUTE VERIFICATION#

Get loaded policy from kernel, and load policy into the kernel.

The library will be implemented in ima-evm-utils repository. It will have similar role like libsmack for smackfs.

The main purpose for the library is to make using of kernel API easier.

The library will use the kernel interfaces to implement the API.

type of file (executable/non executable)Īny of these criteria can be mixed together in any combination.

Policy can be based on different criteria like:

#LINUX KERNEL EXTENDED ATTRIBUTE UPDATE#

EVM_STATE_FIX - No integrity check - hash is update on file close.

Permission denied is returned on integrity violations.

EVM_STATE_ENABLED - EVM checks integrity of files.

EVM_STATE_DISABLED - EVM if turned off.

No permission denied - only log on integrity violations.

IMA_STATE_IGNORE - (AKA IMA_STATE_LOG) IMA checks integrity of every file covered by policy.

IMA_STATE_FIX - IMA doesn't check file integrity.

IMA_STATE_ENFORCE - IMA checks integrity of every file covered by policy.

IMA_STATE_DISABLED - IMA is turned off.

Interface for reading list of measured files (files that have been open or executed from last reboot, the list contains a status of files).

IMA runtime disable/enforce/ignore/fix switch.

Policy read interface (reading policy loaded into the kernel).

Interface for loading policy (policy should be authorized with signature).

Get list of measured files/Check file status.

The dependency between the modules are shown on the diagram: Also the controller process, test UI application and test remote managing service will be provided. An additional library (libimaevm) will be implemented, to make using the interface easier. The kernel feature will be extended with additional interfaces. To implement this solution in Tizen the existing IMA/EVM Linux kernel feature will be used. Fox example: file path, owner of the file, owner of process, LSM labels, etc. The policy describes files that should be checked - it can be based on various criteria. On the device only the public key is present - so infringement of any file is impossible without noticing. While opening the file kernel will check correctness of the signature and will take appropriate action (open file, return permission denied, log, etc.). This means that in extended attributes of every file (covered by policy) is digital signature of file content. The simplest case is to sign every file with digital signature. IMA checks file content and compares it with hash or signature stored in security.ima extended attributes.ĮVM checks content of extended attributes from security domain (security.ima, security.SMACK4, etc.) and compares it with secure hash (HMAC) or signature stored in security.evm. It gives the possibility to create a policy that describes which files have to be checked. It gives possibility to check every file if it was compromised. System checks files before open (and/or execute) if they were not suspiciously modified, and according to the specified action it will: report the violation, block access to the file, or just ignore result of measurement. If gives possibility to check if important files in system haven't been modified by unauthorized person.

#LINUX KERNEL EXTENDED ATTRIBUTE VERIFICATION#

Integrity Measurement Architecture/Extended Verification Module (IMA/EVM) it's a module that allows to check integrity of the system.

6 Test UI application, test console tool, test server.

Linux kernel extended attribute