The Integrity Measurement Architecture (IMA) maintains a measurement list —a record of system events used for integrity verification. The IMA event logs are the entries within this measurement list, each representing a specific event or measurement that contributes to the system's integrity assessment.
This update introduces the ability to trim, or remove, N entries from the current measurement list. Trimming involves deleting N entries from the list and clearing the corresponding entries from the hash table. This action atomically truncates the measurement list, ensuring that no new measurements can be added until the operation is complete. Importantly, only one writer can initiate this trimming process at a time, maintaining consistency and preventing race conditions. A userspace interface, ima_trim_log, has been provided for this purpose. By writing a number N to this interface, userspace can request the kernel to trim N entries from the IMA event logs. When this interface is read, it returns the number of entries trimmed during the last operation. This value is not preserved across kexec soft reboots, as it is not considered important information. To maintain a complete record, userspace is responsible for concatenating and storing the logs before initiating trimming. Userspace can then send the collected data to remote verifiers for validation. After receiving confirmation from the remote verifiers, userspace may instruct the kernel to proceed with trimming the IMA event logs accordingly. The primary benefit of this solution is the ability to free valuable kernel memory by delegating the task of reconstructing the full measurement list from log chunks to userspace. Trust is not required in userspace for the integrity of the measurement list, as its integrity is cryptographically protected by the Trusted Platform Module (TPM). Multiple readers are allowed to access the ima_trim_log interface concurrently, while only one writer can trigger log trimming at any time. During trimming, readers do not see the list and cannot access it while deletion is in progress, ensuring atomicity. Introduce the new kernel option ima_flush_htable to decide whether or not the digests of measurement entries are flushed from the hash table. (from reference [2]) The ima_measure_users counter (protected by the ima_measure_lock mutex) has been introduced to protect access to the measurement list part. The open method of all the measurement interfaces has been extended to allow only one writer at a time or, in alternative, multiple readers. The write permission is used to delete the measurements, the read permission to read them. Write requires also the CAP_SYS_ADMIN capability. (from reference [2]) New IMA log trim event is added when trimming finish. The time required for trimming is minimal, and IMA event logs are briefly on hold during this process, preventing read or add operations. This short interruption has no impact on the overall functionality of IMA. V1 of this series is available here[1] for reference. References: ----------- [1] [PATCH 0/1] Trim N entries of IMA event logs https://lore.kernel.org/linux-integrity/[email protected]/T/#t [2] [RFC][PATCH] ima: Add support for staging measurements for deletion https://lore.kernel.org/linux-integrity/[email protected]/T/#t Change Log v2: - Incorporated feedback from the Roberto on v1 series. - Adapted code from Roberto's RFC [Reference 2] - Add IMA log trim event log to record trim event - Updated patch descriptions as necessary. steven chen (1): IMA event log trimming .../admin-guide/kernel-parameters.txt | 4 + security/integrity/ima/ima.h | 2 + security/integrity/ima/ima_fs.c | 175 +++++++++++++++++- security/integrity/ima/ima_queue.c | 64 +++++++ 4 files changed, 241 insertions(+), 4 deletions(-) -- 2.43.0
