← Documents Documentation/ABI/testing/ima_policy GitHub 원문 ↗

Linux 6.18.37 · ABI / testing

IMA runtime policy securityfs ABI

IMA measure·appraise·audit·hash policy의 action·base·LSM·option grammar, close 시 activation, default exclusions, PCR·keyring·modsig·SETXATTR·fs-verity sigv3 rules를 설명합니다.

Source pathDocumentation/ABI/testing/ima_policy
Source versionLinux v6.18.37
TranslationDUJINLABS 전문 번역 + 해설

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

Policy load transaction과 rule grammar

ima_policy:1-32

ima/policy를 열고 rule을 한 줄씩 쓴 뒤 닫으면 새 policy가 발효됩니다. Action은 measure·dont_measure·appraise·dont_appraise·audit·hash·dont_hash이고 base·LSM condition과 option을 조합합니다.

Base·LSM conditions와 policy options

ima_policy:33-78

func·mask·filesystem·identity 조건과 LSM subject·object labels를 사용하며 signature type, fs-verity digest, keyrings, template, PCR, critical-data label, accepted appraisal algorithms를 제한할 수 있습니다.

Default measure·appraise policy

ima_policy:80-124

Default policy는 pseudo-filesystem magic을 제외하고 executable, executable mmap, root read, module, firmware를 측정하며 root-owned file을 appraise합니다.

LSM·PCR·modsig·keyring examples

ima_policy:126-157

SELinux·Smack labels, alternate PCR, appended module signature, 모든 key 또는 지정 keyring만 측정하는 rule 예제를 제공합니다.

SETXATTR algorithms와 fs-verity sigv3

ima_policy:159-190

SETXATTR_CHECK는 security.ima에 허용할 hash algorithms를 제한하고, digest_type=verity는 ima-ngv2·ima-sigv3 measurement와 sigv3 appraisal을 구성합니다.

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기
1 What: /sys/kernel/security/*/ima/policy
2 Date: May 2008
3 Contact: Mimi Zohar <zohar@us.ibm.com>
4 Description:
5 The Trusted Computing Group(TCG) runtime Integrity
6 Measurement Architecture(IMA) maintains a list of hash
7 values of executables and other sensitive system files
8 loaded into the run-time of this system. At runtime,
9 the policy can be constrained based on LSM specific data.
10 Policies are loaded into the securityfs file ima/policy
11 by opening the file, writing the rules one at a time and
12 then closing the file. The new policy takes effect after
13 the file ima/policy is closed.
14
15 IMA appraisal, if configured, uses these file measurements
16 for local measurement appraisal.
17
18 ::
19
20 rule format: action [condition ...]
21
22 action: measure | dont_measure | appraise | dont_appraise |
23 audit | hash | dont_hash
24 condition:= base | lsm [option]
25 base: [[func=] [mask=] [fsmagic=] [fsuuid=] [fsname=]
26 [uid=] [euid=] [gid=] [egid=]
27 [fowner=] [fgroup=]]
28 lsm: [[subj_user=] [subj_role=] [subj_type=]
29 [obj_user=] [obj_role=] [obj_type=]]
30 option: [digest_type=] [template=] [permit_directio]
31 [appraise_type=] [appraise_flag=]
32 [appraise_algos=] [keyrings=]
33 base:
34 func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]
35 [FIRMWARE_CHECK]
36 [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
37 [KEXEC_CMDLINE] [KEY_CHECK] [CRITICAL_DATA]
38 [SETXATTR_CHECK][MMAP_CHECK_REQPROT]
39 mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
40 [[^]MAY_EXEC]
41 fsmagic:= hex value
42 fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
43 uid:= decimal value
44 euid:= decimal value
45 gid:= decimal value
46 egid:= decimal value
47 fowner:= decimal value
48 fgroup:= decimal value
49 lsm: are LSM specific
50 option:
51 appraise_type:= [imasig] | [imasig|modsig] | [sigv3]
52 where 'imasig' is the original or the signature
53 format v2.
54 where 'modsig' is an appended signature,
55 where 'sigv3' is the signature format v3. (Currently
56 limited to fsverity digest based signatures
57 stored in security.ima xattr. Requires
58 specifying "digest_type=verity" first.)
59
60 appraise_flag:= [check_blacklist] (deprecated)
61 Setting the check_blacklist flag is no longer necessary.
62 All appraisal functions set it by default.
63 digest_type:= verity
64 Require fs-verity's file digest instead of the
65 regular IMA file hash.
66 keyrings:= list of keyrings
67 (eg, .builtin_trusted_keys|.ima). Only valid
68 when action is "measure" and func is KEY_CHECK.
69 template:= name of a defined IMA template type
70 (eg, ima-ng). Only valid when action is "measure".
71 pcr:= decimal value
72 label:= [selinux]|[kernel_info]|[data_label]
73 data_label:= a unique string used for grouping and limiting critical data.
74 For example, "selinux" to measure critical data for SELinux.
75 appraise_algos:= comma-separated list of hash algorithms
76 For example, "sha256,sha512" to only accept to appraise
77 files where the security.ima xattr was hashed with one
78 of these two algorithms.
79
80 default policy:
81 # PROC_SUPER_MAGIC
82 dont_measure fsmagic=0x9fa0
83 dont_appraise fsmagic=0x9fa0
84 # SYSFS_MAGIC
85 dont_measure fsmagic=0x62656572
86 dont_appraise fsmagic=0x62656572
87 # DEBUGFS_MAGIC
88 dont_measure fsmagic=0x64626720
89 dont_appraise fsmagic=0x64626720
90 # TMPFS_MAGIC
91 dont_measure fsmagic=0x01021994
92 dont_appraise fsmagic=0x01021994
93 # RAMFS_MAGIC
94 dont_appraise fsmagic=0x858458f6
95 # DEVPTS_SUPER_MAGIC
96 dont_measure fsmagic=0x1cd1
97 dont_appraise fsmagic=0x1cd1
98 # BINFMTFS_MAGIC
99 dont_measure fsmagic=0x42494e4d
100 dont_appraise fsmagic=0x42494e4d
101 # SECURITYFS_MAGIC
102 dont_measure fsmagic=0x73636673
103 dont_appraise fsmagic=0x73636673
104 # SELINUX_MAGIC
105 dont_measure fsmagic=0xf97cff8c
106 dont_appraise fsmagic=0xf97cff8c
107 # CGROUP_SUPER_MAGIC
108 dont_measure fsmagic=0x27e0eb
109 dont_appraise fsmagic=0x27e0eb
110 # NSFS_MAGIC
111 dont_measure fsmagic=0x6e736673
112 dont_appraise fsmagic=0x6e736673
113
114 measure func=BPRM_CHECK
115 measure func=FILE_MMAP mask=MAY_EXEC
116 measure func=FILE_CHECK mask=MAY_READ uid=0
117 measure func=MODULE_CHECK
118 measure func=FIRMWARE_CHECK
119 appraise fowner=0
120
121 The default policy measures all executables in bprm_check,
122 all files mmapped executable in file_mmap, and all files
123 open for read by root in do_filp_open. The default appraisal
124 policy appraises all files owned by root.
125
126 Examples of LSM specific definitions:
127
128 SELinux::
129
130 dont_measure obj_type=var_log_t
131 dont_appraise obj_type=var_log_t
132 dont_measure obj_type=auditd_log_t
133 dont_appraise obj_type=auditd_log_t
134 measure subj_user=system_u func=FILE_CHECK mask=MAY_READ
135 measure subj_role=system_r func=FILE_CHECK mask=MAY_READ
136
137 Smack::
138
139 measure subj_user=_ func=FILE_CHECK mask=MAY_READ
140
141 Example of measure rules using alternate PCRs::
142
143 measure func=KEXEC_KERNEL_CHECK pcr=4
144 measure func=KEXEC_INITRAMFS_CHECK pcr=5
145
146 Example of appraise rule allowing modsig appended signatures:
147
148 appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig
149
150 Example of measure rule using KEY_CHECK to measure all keys:
151
152 measure func=KEY_CHECK
153
154 Example of measure rule using KEY_CHECK to only measure
155 keys added to .builtin_trusted_keys or .ima keyring:
156
157 measure func=KEY_CHECK keyrings=.builtin_trusted_keys|.ima
158
159 Example of the special SETXATTR_CHECK appraise rule, that
160 restricts the hash algorithms allowed when writing to the
161 security.ima xattr of a file:
162
163 appraise func=SETXATTR_CHECK appraise_algos=sha256,sha384,sha512
164
165 Example of a 'measure' rule requiring fs-verity's digests
166 with indication of type of digest in the measurement list.
167
168 measure func=FILE_CHECK digest_type=verity \
169 template=ima-ngv2
170
171 Example of 'measure' and 'appraise' rules requiring fs-verity
172 signatures (format version 3) stored in security.ima xattr.
173
174 The 'measure' rule specifies the 'ima-sigv3' template option,
175 which includes the indication of type of digest and the file
176 signature in the measurement list.
177
178 measure func=BPRM_CHECK digest_type=verity \
179 template=ima-sigv3
180
181
182 The 'appraise' rule specifies the type and signature format
183 version (sigv3) required.
184
185 appraise func=BPRM_CHECK digest_type=verity \
186 appraise_type=sigv3
187
188 All of these policy rules could, for example, be constrained
189 either based on a filesystem's UUID (fsuuid) or based on LSM
190 labels.
191

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

IMA policy load와 grammar

1-32
항목내용
What/sys/kernel/security/*/ima/policy
Date2008년 5월
ContactMimi Zohar <zohar@us.ibm.com>

TCG(Trusted Computing Group) runtime IMA(Integrity Measurement Architecture)는 이 system의 runtime에 load된 executable과 그 밖의 민감한 system file의 hash value 목록을 유지합니다. Runtime에는 LSM-specific data를 기준으로 policy를 제한할 수 있습니다.

Policy를 securityfs file ima/policy에 load하려면 file을 열고 rule을 한 번에 하나씩 쓴 뒤 file을 닫습니다. 새 policy는 ima/policy file을 닫은 뒤 발효됩니다.

IMA appraisal이 구성되어 있다면 local measurement appraisal에 이 file measurement를 사용합니다.

rule format: action [condition ...]

action: measure | dont_measure | appraise | dont_appraise |
        audit | hash | dont_hash
condition:= base | lsm  [option]
  base: [[func=] [mask=] [fsmagic=] [fsuuid=] [fsname=]
         [uid=] [euid=] [gid=] [egid=]
         [fowner=] [fgroup=]]
  lsm:  [[subj_user=] [subj_role=] [subj_type=]
         [obj_user=] [obj_role=] [obj_type=]]
  option: [digest_type=] [template=] [permit_directio]
          [appraise_type=] [appraise_flag=]
          [appraise_algos=] [keyrings=]

Base·LSM condition과 option 정의

33-78 
func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]
       [FIRMWARE_CHECK]
       [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
       [KEXEC_CMDLINE] [KEY_CHECK] [CRITICAL_DATA]
       [SETXATTR_CHECK][MMAP_CHECK_REQPROT]
mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
       [[^]MAY_EXEC]
Base field정의
fsmagicHex value
fsuuidFile system UUID, 예: 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6
uidDecimal value
euidDecimal value
gidDecimal value
egidDecimal value
fownerDecimal value
fgroupDecimal value
lsmLSM-specific fields
Option전문 번역
appraise_type[imasig] | [imasig|modsig] | [sigv3]. imasig는 original signature 또는 signature format v2이고, modsig는 appended signature이며, sigv3는 signature format v3입니다. Sigv3는 현재 security.ima xattr에 저장된 fsverity digest 기반 signature로 제한되며 먼저 digest_type=verity를 지정해야 합니다.
appraise_flag[check_blacklist], deprecated. check_blacklist flag 설정은 더는 필요하지 않으며 모든 appraisal function이 기본으로 설정합니다.
digest_typeverity. 일반 IMA file hash 대신 fs-verity file digest를 요구합니다.
keyrings.builtin_trusted_keys|.ima 같은 keyring 목록입니다. Action이 measure이고 func가 KEY_CHECK일 때만 유효합니다.
templateima-ng 같은 정의된 IMA template type 이름입니다. Action이 measure일 때만 유효합니다.
pcrDecimal value
label[selinux]|[kernel_info]|[data_label]
data_labelCritical data를 grouping하고 제한하는 데 쓰는 unique string입니다. 예를 들어 SELinux critical data를 측정하려면 selinux를 사용합니다.
appraise_algosComma-separated hash algorithm 목록입니다. 예를 들어 sha256,sha512는 security.ima xattr가 이 두 algorithm 중 하나로 hash된 file만 appraisal 대상으로 받아들입니다.

Default IMA policy

80-124 
# PROC_SUPER_MAGIC
dont_measure fsmagic=0x9fa0
dont_appraise fsmagic=0x9fa0
# SYSFS_MAGIC
dont_measure fsmagic=0x62656572
dont_appraise fsmagic=0x62656572
# DEBUGFS_MAGIC
dont_measure fsmagic=0x64626720
dont_appraise fsmagic=0x64626720
# TMPFS_MAGIC
dont_measure fsmagic=0x01021994
dont_appraise fsmagic=0x01021994
# RAMFS_MAGIC
dont_appraise fsmagic=0x858458f6
# DEVPTS_SUPER_MAGIC
dont_measure fsmagic=0x1cd1
dont_appraise fsmagic=0x1cd1
# BINFMTFS_MAGIC
dont_measure fsmagic=0x42494e4d
dont_appraise fsmagic=0x42494e4d
# SECURITYFS_MAGIC
dont_measure fsmagic=0x73636673
dont_appraise fsmagic=0x73636673
# SELINUX_MAGIC
dont_measure fsmagic=0xf97cff8c
dont_appraise fsmagic=0xf97cff8c
# CGROUP_SUPER_MAGIC
dont_measure fsmagic=0x27e0eb
dont_appraise fsmagic=0x27e0eb
# NSFS_MAGIC
dont_measure fsmagic=0x6e736673
dont_appraise fsmagic=0x6e736673

measure func=BPRM_CHECK
measure func=FILE_MMAP mask=MAY_EXEC
measure func=FILE_CHECK mask=MAY_READ uid=0
measure func=MODULE_CHECK
measure func=FIRMWARE_CHECK
appraise fowner=0

Default policy는 bprm_check의 모든 executable, file_mmap에서 executable로 mmap한 모든 file, do_filp_open에서 root가 read용으로 연 모든 file을 측정합니다. Default appraisal policy는 root가 소유한 모든 file을 appraise합니다.

LSM·PCR·signature·key policy 예제

126-157

LSM-specific definition의 SELinux 예:

dont_measure obj_type=var_log_t
dont_appraise obj_type=var_log_t
dont_measure obj_type=auditd_log_t
dont_appraise obj_type=auditd_log_t
measure subj_user=system_u func=FILE_CHECK mask=MAY_READ
measure subj_role=system_r func=FILE_CHECK mask=MAY_READ

Smack 예:

measure subj_user=_ func=FILE_CHECK mask=MAY_READ

Alternate PCR을 사용하는 measure rule 예:

measure func=KEXEC_KERNEL_CHECK pcr=4
measure func=KEXEC_INITRAMFS_CHECK pcr=5

Modsig appended signature를 허용하는 appraise rule 예:

appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig

KEY_CHECK로 모든 key를 측정하는 measure rule 예:

measure func=KEY_CHECK

KEY_CHECK로 .builtin_trusted_keys 또는 .ima keyring에 추가된 key만 측정하는 measure rule 예:

measure func=KEY_CHECK keyrings=.builtin_trusted_keys|.ima

SETXATTR_CHECK와 fs-verity policy

159-190

File의 security.ima xattr에 쓸 때 허용할 hash algorithm을 제한하는 special SETXATTR_CHECK appraise rule 예:

appraise func=SETXATTR_CHECK appraise_algos=sha256,sha384,sha512

Measurement list에 digest type 표시를 포함하고 fs-verity digest를 요구하는 measure rule 예:

measure func=FILE_CHECK digest_type=verity \
        template=ima-ngv2

Security.ima xattr에 저장된 fs-verity signature, 즉 format version 3을 요구하는 measure·appraise rule 예입니다. Measure rule은 digest type 표시와 file signature를 measurement list에 포함하는 ima-sigv3 template option을 지정합니다.

measure func=BPRM_CHECK digest_type=verity \
        template=ima-sigv3

Appraise rule은 요구하는 type과 signature format version sigv3를 지정합니다.

appraise func=BPRM_CHECK digest_type=verity \
        appraise_type=sigv3

이 모든 policy rule은 예를 들어 filesystem UUID(fsuuid) 또는 LSM label을 기준으로 추가 제한할 수 있습니다.

IMA policy load와 rule evaluation
Open ima/policyWrite one rule at a timeClose fileNew policy takes effect
Runtime IMA hook funcBase and LSM conditionsmeasure, appraise, audit, hash or dont actionTemplate, PCR, keyring, digest and signature options
SETXATTR_CHECKRestrict security.ima hash algorithms
digest_type=verityfs-verity digestima-ngv2 or ima-sigv3 measurementsigv3 appraisal

Policy는 open·여러 rule write·close transaction으로 교체되고 각 hook에서 action, condition, option을 평가한다.