Sites may wish to provide additional metadata alongside files in order to make more fine-grained security decisions[1]. The security of this is enhanced if this metadata is protected, something that EVM makes possible. However, the kernel cannot know about the set of extended attributes that local admins may wish to protect, and hardcoding this policy in the kernel makes it difficult to change over time and less convenient for distributions to enable. This patch adds a new /sys/kernel/security/integrity/evm/evm_xattrs node, which can be read to obtain the current set of EVM-protected extended attributes or written to in order to add new entries. Extending this list will not change the validity of any existing signatures provided that the file in question does not have any of the additional extended attributes - missing xattrs are skipped when calculating the EVM hash. [1] For instance, a package manager could install information about the package uploader in an additional extended attribute. Local LSM policy could then be associated with that extended attribute in order to restrict the privileges available to packages from less trusted uploaders.
Showing the changes to include/uapi/linux (1 of 6 files). Show all
Unified · Split
| @@ -147,6 +147,7 @@ · 146 unmodified lines | ||
| 147 | 147 | #define AUDIT_INTEGRITY_HASH 1803 /* Integrity HASH type */ |
| 148 | 148 | #define AUDIT_INTEGRITY_PCR 1804 /* PCR invalidation msgs */ |
| 149 | 149 | #define AUDIT_INTEGRITY_RULE 1805 /* policy rule */ |
| 150 | +#define AUDIT_INTEGRITY_EVM_XATTR 1806 /* New EVM-covered xattr */ | |
| 150 | 151 | |
| 151 | 152 | #define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */ |
| 152 | 153 | |