ima_policy

  1What:		/sys/kernel/security/*/ima/policy
  2Date:		May 2008
  3Contact:	Mimi Zohar <zohar@us.ibm.com>
  4Description:
  5		The Trusted Computing Group(TCG) runtime Integrity
  6		Measurement Architecture(IMA) maintains a list of hash
  7		values of executables and other sensitive system files
  8		loaded into the run-time of this system.  At runtime,
  9		the policy can be constrained based on LSM specific data.
 10		Policies are loaded into the securityfs file ima/policy
 11		by opening the file, writing the rules one at a time and
 12		then closing the file.  The new policy takes effect after
 13		the file ima/policy is closed.
 14
 15		IMA appraisal, if configured, uses these file measurements
 16		for local measurement appraisal.
 17
 18		::
 19
 20		  rule format: action [condition ...]
 21
 22		  action: measure | dont_measure | appraise | dont_appraise |
 23			  audit | dont_audit | hash | dont_hash
 24		  condition:= base | lsm  [option]
 25			base:	[[func=] [mask=] [fsmagic=] [fsuuid=] [fsname=]
 26				[fs_subtype=]
 27				[uid=] [euid=] [gid=] [egid=]
 28				[fowner=] [fgroup=]]
 29			lsm:	[[subj_user=] [subj_role=] [subj_type=]
 30				 [obj_user=] [obj_role=] [obj_type=]]
 31			option:	[digest_type=] [template=] [permit_directio]
 32				[appraise_type=] [appraise_flag=]
 33				[appraise_algos=] [keyrings=]
 34		  base:
 35			func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]
 36				[FIRMWARE_CHECK]
 37				[KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
 38				[KEXEC_CMDLINE] [KEY_CHECK] [CRITICAL_DATA]
 39				[SETXATTR_CHECK][MMAP_CHECK_REQPROT]
 40			mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
 41			       [[^]MAY_EXEC]
 42			fsmagic:= hex value
 43			fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
 44			uid:= decimal value
 45			euid:= decimal value
 46			gid:= decimal value
 47			egid:= decimal value
 48			fowner:= decimal value
 49			fgroup:= decimal value
 50		  lsm:  are LSM specific
 51		  option:
 52			appraise_type:= [imasig] | [imasig|modsig] | [sigv3]
 53			    where 'imasig' is the original or the signature
 54				format v2.
 55			    where 'modsig' is an appended signature,
 56			    where 'sigv3' is the signature format v3. (Currently
 57				limited to fsverity digest based signatures
 58				stored in security.ima xattr. Requires
 59				specifying "digest_type=verity" first.)
 60
 61			appraise_flag:= [check_blacklist] (deprecated)
 62			Setting the check_blacklist flag is no longer necessary.
 63			All appraisal functions set it by default.
 64			digest_type:= verity
 65			    Require fs-verity's file digest instead of the
 66			    regular IMA file hash.
 67			keyrings:= list of keyrings
 68			(eg, .builtin_trusted_keys|.ima). Only valid
 69			when action is "measure" and func is KEY_CHECK.
 70			template:= name of a defined IMA template type
 71			(eg, ima-ng). Only valid when action is "measure".
 72			pcr:= decimal value
 73			label:= [selinux]|[kernel_info]|[data_label]
 74			data_label:= a unique string used for grouping and limiting critical data.
 75			For example, "selinux" to measure critical data for SELinux.
 76			appraise_algos:= comma-separated list of hash algorithms
 77			For example, "sha256,sha512" to only accept to appraise
 78			files where the security.ima xattr was hashed with one
 79			of these two algorithms.
 80
 81		  default policy:
 82			# PROC_SUPER_MAGIC
 83			dont_measure fsmagic=0x9fa0
 84			dont_appraise fsmagic=0x9fa0
 85			# SYSFS_MAGIC
 86			dont_measure fsmagic=0x62656572
 87			dont_appraise fsmagic=0x62656572
 88			# DEBUGFS_MAGIC
 89			dont_measure fsmagic=0x64626720
 90			dont_appraise fsmagic=0x64626720
 91			# TMPFS_MAGIC
 92			dont_measure fsmagic=0x01021994
 93			dont_appraise fsmagic=0x01021994
 94			# RAMFS_MAGIC
 95			dont_appraise fsmagic=0x858458f6
 96			# DEVPTS_SUPER_MAGIC
 97			dont_measure fsmagic=0x1cd1
 98			dont_appraise fsmagic=0x1cd1
 99			# BINFMTFS_MAGIC
100			dont_measure fsmagic=0x42494e4d
101			dont_appraise fsmagic=0x42494e4d
102			# SECURITYFS_MAGIC
103			dont_measure fsmagic=0x73636673
104			dont_appraise fsmagic=0x73636673
105			# SELINUX_MAGIC
106			dont_measure fsmagic=0xf97cff8c
107			dont_appraise fsmagic=0xf97cff8c
108			# CGROUP_SUPER_MAGIC
109			dont_measure fsmagic=0x27e0eb
110			dont_appraise fsmagic=0x27e0eb
111			# NSFS_MAGIC
112			dont_measure fsmagic=0x6e736673
113			dont_appraise fsmagic=0x6e736673
114
115			measure func=BPRM_CHECK
116			measure func=FILE_MMAP mask=MAY_EXEC
117			measure func=FILE_CHECK mask=MAY_READ uid=0
118			measure func=MODULE_CHECK
119			measure func=FIRMWARE_CHECK
120			appraise fowner=0
121
122		The default policy measures all executables in bprm_check,
123		all files mmapped executable in file_mmap, and all files
124		open for read by root in do_filp_open.  The default appraisal
125		policy appraises all files owned by root.
126
127		Examples of LSM specific definitions:
128
129		SELinux::
130
131			dont_measure obj_type=var_log_t
132			dont_appraise obj_type=var_log_t
133			dont_measure obj_type=auditd_log_t
134			dont_appraise obj_type=auditd_log_t
135			measure subj_user=system_u func=FILE_CHECK mask=MAY_READ
136			measure subj_role=system_r func=FILE_CHECK mask=MAY_READ
137
138		Smack::
139
140			measure subj_user=_ func=FILE_CHECK mask=MAY_READ
141
142		Example of measure rules using alternate PCRs::
143
144			measure func=KEXEC_KERNEL_CHECK pcr=4
145			measure func=KEXEC_INITRAMFS_CHECK pcr=5
146
147		Example of appraise rule allowing modsig appended signatures:
148
149			appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig
150
151		Example of measure rule using KEY_CHECK to measure all keys:
152
153			measure func=KEY_CHECK
154
155		Example of measure rule using KEY_CHECK to only measure
156		keys added to .builtin_trusted_keys or .ima keyring:
157
158			measure func=KEY_CHECK keyrings=.builtin_trusted_keys|.ima
159
160		Example of the special SETXATTR_CHECK appraise rule, that
161		restricts the hash algorithms allowed when writing to the
162		security.ima xattr of a file:
163
164			appraise func=SETXATTR_CHECK appraise_algos=sha256,sha384,sha512
165
166		Example of a 'measure' rule requiring fs-verity's digests
167		with indication of type of digest in the measurement list.
168
169			measure func=FILE_CHECK digest_type=verity \
170				template=ima-ngv2
171
172		Example of 'measure' and 'appraise' rules requiring fs-verity
173		signatures (format version 3) stored in security.ima xattr.
174
175		The 'measure' rule specifies the 'ima-sigv3' template option,
176		which includes the indication of type of digest and the file
177		signature in the measurement list.
178
179			measure func=BPRM_CHECK digest_type=verity \
180				template=ima-sigv3
181
182
183		The 'appraise' rule specifies the type and signature format
184		version (sigv3) required.
185
186			appraise func=BPRM_CHECK digest_type=verity \
187				appraise_type=sigv3
188
189		All of these policy rules could, for example, be constrained
190		either based on a filesystem's UUID (fsuuid) or based on LSM
191		labels.