1What: security/ima/policy 2Date: May 2008 3Contact: Mimi Zohar <zohar@us.ibm.com> 4Description: 5 The Trusted Computing Group(TCG) runtime Integrity 6 Measurement Architecture(IMA) maintains a list of hash 7 values of executables and other sensitive system files 8 loaded into the run-time of this system. At runtime, 9 the policy can be constrained based on LSM specific data. 10 Policies are loaded into the securityfs file ima/policy 11 by opening the file, writing the rules one at a time and 12 then closing the file. The new policy takes effect after 13 the file ima/policy is closed. 14 15 IMA appraisal, if configured, uses these file measurements 16 for local measurement appraisal. 17 18 rule format: action [condition ...] 19 20 action: measure | dont_measure | appraise | dont_appraise | 21 audit | hash | dont_hash 22 condition:= base | lsm [option] 23 base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=] 24 [euid=] [fowner=] [fsname=]] 25 lsm: [[subj_user=] [subj_role=] [subj_type=] 26 [obj_user=] [obj_role=] [obj_type=]] 27 option: [[appraise_type=]] [template=] [permit_directio] 28 [appraise_flag=] 29 base: func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK] 30 [FIRMWARE_CHECK] 31 [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK] 32 [KEXEC_CMDLINE] [KEY_CHECK] 33 mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] 34 [[^]MAY_EXEC] 35 fsmagic:= hex value 36 fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6) 37 uid:= decimal value 38 euid:= decimal value 39 fowner:= decimal value 40 lsm: are LSM specific 41 option: appraise_type:= [imasig] [imasig|modsig] 42 appraise_flag:= [check_blacklist] 43 Currently, blacklist check is only for files signed with appended 44 signature. 45 template:= name of a defined IMA template type 46 (eg, ima-ng). Only valid when action is "measure". 47 pcr:= decimal value 48 49 default policy: 50 # PROC_SUPER_MAGIC 51 dont_measure fsmagic=0x9fa0 52 dont_appraise fsmagic=0x9fa0 53 # SYSFS_MAGIC 54 dont_measure fsmagic=0x62656572 55 dont_appraise fsmagic=0x62656572 56 # DEBUGFS_MAGIC 57 dont_measure fsmagic=0x64626720 58 dont_appraise fsmagic=0x64626720 59 # TMPFS_MAGIC 60 dont_measure fsmagic=0x01021994 61 dont_appraise fsmagic=0x01021994 62 # RAMFS_MAGIC 63 dont_appraise fsmagic=0x858458f6 64 # DEVPTS_SUPER_MAGIC 65 dont_measure fsmagic=0x1cd1 66 dont_appraise fsmagic=0x1cd1 67 # BINFMTFS_MAGIC 68 dont_measure fsmagic=0x42494e4d 69 dont_appraise fsmagic=0x42494e4d 70 # SECURITYFS_MAGIC 71 dont_measure fsmagic=0x73636673 72 dont_appraise fsmagic=0x73636673 73 # SELINUX_MAGIC 74 dont_measure fsmagic=0xf97cff8c 75 dont_appraise fsmagic=0xf97cff8c 76 # CGROUP_SUPER_MAGIC 77 dont_measure fsmagic=0x27e0eb 78 dont_appraise fsmagic=0x27e0eb 79 # NSFS_MAGIC 80 dont_measure fsmagic=0x6e736673 81 dont_appraise fsmagic=0x6e736673 82 83 measure func=BPRM_CHECK 84 measure func=FILE_MMAP mask=MAY_EXEC 85 measure func=FILE_CHECK mask=MAY_READ uid=0 86 measure func=MODULE_CHECK 87 measure func=FIRMWARE_CHECK 88 appraise fowner=0 89 90 The default policy measures all executables in bprm_check, 91 all files mmapped executable in file_mmap, and all files 92 open for read by root in do_filp_open. The default appraisal 93 policy appraises all files owned by root. 94 95 Examples of LSM specific definitions: 96 97 SELinux: 98 dont_measure obj_type=var_log_t 99 dont_appraise obj_type=var_log_t 100 dont_measure obj_type=auditd_log_t 101 dont_appraise obj_type=auditd_log_t 102 measure subj_user=system_u func=FILE_CHECK mask=MAY_READ 103 measure subj_role=system_r func=FILE_CHECK mask=MAY_READ 104 105 Smack: 106 measure subj_user=_ func=FILE_CHECK mask=MAY_READ 107 108 Example of measure rules using alternate PCRs: 109 110 measure func=KEXEC_KERNEL_CHECK pcr=4 111 measure func=KEXEC_INITRAMFS_CHECK pcr=5 112 113 Example of appraise rule allowing modsig appended signatures: 114 115 appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig 116 117 Example of measure rule using KEY_CHECK to measure all keys: 118 119 measure func=KEY_CHECK 120