Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1What: security/ima/policy
2Date: May 2008
3Contact: Mimi Zohar <zohar@us.ibm.com>
4Description:
5 The Trusted Computing Group(TCG) runtime Integrity
6 Measurement Architecture(IMA) maintains a list of hash
7 values of executables and other sensitive system files
8 loaded into the run-time of this system. At runtime,
9 the policy can be constrained based on LSM specific data.
10 Policies are loaded into the securityfs file ima/policy
11 by opening the file, writing the rules one at a time and
12 then closing the file. The new policy takes effect after
13 the file ima/policy is closed.
14
15 IMA appraisal, if configured, uses these file measurements
16 for local measurement appraisal.
17
18 rule format: action [condition ...]
19
20 action: measure | dont_measure | appraise | dont_appraise |
21 audit | hash | dont_hash
22 condition:= base | lsm [option]
23 base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
24 [euid=] [fowner=] [fsname=]]
25 lsm: [[subj_user=] [subj_role=] [subj_type=]
26 [obj_user=] [obj_role=] [obj_type=]]
27 option: [[appraise_type=]] [template=] [permit_directio]
28 [appraise_flag=]
29 base: func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]
30 [FIRMWARE_CHECK]
31 [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
32 [KEXEC_CMDLINE]
33 mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
34 [[^]MAY_EXEC]
35 fsmagic:= hex value
36 fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
37 uid:= decimal value
38 euid:= decimal value
39 fowner:= decimal value
40 lsm: are LSM specific
41 option: appraise_type:= [imasig] [imasig|modsig]
42 appraise_flag:= [check_blacklist]
43 Currently, blacklist check is only for files signed with appended
44 signature.
45 template:= name of a defined IMA template type
46 (eg, ima-ng). Only valid when action is "measure".
47 pcr:= decimal value
48
49 default policy:
50 # PROC_SUPER_MAGIC
51 dont_measure fsmagic=0x9fa0
52 dont_appraise fsmagic=0x9fa0
53 # SYSFS_MAGIC
54 dont_measure fsmagic=0x62656572
55 dont_appraise fsmagic=0x62656572
56 # DEBUGFS_MAGIC
57 dont_measure fsmagic=0x64626720
58 dont_appraise fsmagic=0x64626720
59 # TMPFS_MAGIC
60 dont_measure fsmagic=0x01021994
61 dont_appraise fsmagic=0x01021994
62 # RAMFS_MAGIC
63 dont_appraise fsmagic=0x858458f6
64 # DEVPTS_SUPER_MAGIC
65 dont_measure fsmagic=0x1cd1
66 dont_appraise fsmagic=0x1cd1
67 # BINFMTFS_MAGIC
68 dont_measure fsmagic=0x42494e4d
69 dont_appraise fsmagic=0x42494e4d
70 # SECURITYFS_MAGIC
71 dont_measure fsmagic=0x73636673
72 dont_appraise fsmagic=0x73636673
73 # SELINUX_MAGIC
74 dont_measure fsmagic=0xf97cff8c
75 dont_appraise fsmagic=0xf97cff8c
76 # CGROUP_SUPER_MAGIC
77 dont_measure fsmagic=0x27e0eb
78 dont_appraise fsmagic=0x27e0eb
79 # NSFS_MAGIC
80 dont_measure fsmagic=0x6e736673
81 dont_appraise fsmagic=0x6e736673
82
83 measure func=BPRM_CHECK
84 measure func=FILE_MMAP mask=MAY_EXEC
85 measure func=FILE_CHECK mask=MAY_READ uid=0
86 measure func=MODULE_CHECK
87 measure func=FIRMWARE_CHECK
88 appraise fowner=0
89
90 The default policy measures all executables in bprm_check,
91 all files mmapped executable in file_mmap, and all files
92 open for read by root in do_filp_open. The default appraisal
93 policy appraises all files owned by root.
94
95 Examples of LSM specific definitions:
96
97 SELinux:
98 dont_measure obj_type=var_log_t
99 dont_appraise obj_type=var_log_t
100 dont_measure obj_type=auditd_log_t
101 dont_appraise obj_type=auditd_log_t
102 measure subj_user=system_u func=FILE_CHECK mask=MAY_READ
103 measure subj_role=system_r func=FILE_CHECK mask=MAY_READ
104
105 Smack:
106 measure subj_user=_ func=FILE_CHECK mask=MAY_READ
107
108 Example of measure rules using alternate PCRs:
109
110 measure func=KEXEC_KERNEL_CHECK pcr=4
111 measure func=KEXEC_INITRAMFS_CHECK pcr=5
112
113 Example of appraise rule allowing modsig appended signatures:
114
115 appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig