Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-17 Thread Lakshmi Ramasubramanian
On 8/17/20 4:11 PM, Mimi Zohar wrote: On Mon, 2020-08-17 at 15:33 -0700, Lakshmi Ramasubramanian wrote: On 8/17/20 3:00 PM, Casey Schaufler wrote: On 8/17/2020 2:31 PM, Mimi Zohar wrote: On Thu, 2020-08-13 at 14:13 -0400, Stephen Smalley wrote: On Thu, Aug 13, 2020 at 2:03 PM Lakshmi

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-17 Thread Mimi Zohar
On Mon, 2020-08-17 at 15:33 -0700, Lakshmi Ramasubramanian wrote: > On 8/17/20 3:00 PM, Casey Schaufler wrote: > > On 8/17/2020 2:31 PM, Mimi Zohar wrote: > > > On Thu, 2020-08-13 at 14:13 -0400, Stephen Smalley wrote: > > > > On Thu, Aug 13, 2020 at 2:03 PM Lakshmi Ramasubramanian > > > > wrote:

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-17 Thread Lakshmi Ramasubramanian
On 8/17/20 3:00 PM, Casey Schaufler wrote: On 8/17/2020 2:31 PM, Mimi Zohar wrote: On Thu, 2020-08-13 at 14:13 -0400, Stephen Smalley wrote: On Thu, Aug 13, 2020 at 2:03 PM Lakshmi Ramasubramanian wrote: On 8/13/20 10:58 AM, Stephen Smalley wrote: On Thu, Aug 13, 2020 at 1:52 PM Lakshmi

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-17 Thread Casey Schaufler
On 8/17/2020 2:31 PM, Mimi Zohar wrote: > On Thu, 2020-08-13 at 14:13 -0400, Stephen Smalley wrote: >> On Thu, Aug 13, 2020 at 2:03 PM Lakshmi Ramasubramanian >> wrote: >>> On 8/13/20 10:58 AM, Stephen Smalley wrote: On Thu, Aug 13, 2020 at 1:52 PM Lakshmi Ramasubramanian wrote: >

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-17 Thread Mimi Zohar
On Thu, 2020-08-13 at 14:13 -0400, Stephen Smalley wrote: > On Thu, Aug 13, 2020 at 2:03 PM Lakshmi Ramasubramanian > wrote: > > On 8/13/20 10:58 AM, Stephen Smalley wrote: > > > On Thu, Aug 13, 2020 at 1:52 PM Lakshmi Ramasubramanian > > > wrote: > > > > On 8/13/20 10:42 AM, Stephen Smalley

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-13 Thread Stephen Smalley
On Thu, Aug 13, 2020 at 2:03 PM Lakshmi Ramasubramanian wrote: > > On 8/13/20 10:58 AM, Stephen Smalley wrote: > > On Thu, Aug 13, 2020 at 1:52 PM Lakshmi Ramasubramanian > > wrote: > >> > >> On 8/13/20 10:42 AM, Stephen Smalley wrote: > >> > diff --git a/security/selinux/measure.c

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-13 Thread Lakshmi Ramasubramanian
On 8/13/20 10:58 AM, Stephen Smalley wrote: On Thu, Aug 13, 2020 at 1:52 PM Lakshmi Ramasubramanian wrote: On 8/13/20 10:42 AM, Stephen Smalley wrote: diff --git a/security/selinux/measure.c b/security/selinux/measure.c new file mode 100644 index ..f21b7de4e2ae --- /dev/null +++

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-13 Thread Stephen Smalley
On Thu, Aug 13, 2020 at 1:52 PM Lakshmi Ramasubramanian wrote: > > On 8/13/20 10:42 AM, Stephen Smalley wrote: > > >> diff --git a/security/selinux/measure.c b/security/selinux/measure.c > >> new file mode 100644 > >> index ..f21b7de4e2ae > >> --- /dev/null > >> +++

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-13 Thread Lakshmi Ramasubramanian
On 8/13/20 10:42 AM, Stephen Smalley wrote: diff --git a/security/selinux/measure.c b/security/selinux/measure.c new file mode 100644 index ..f21b7de4e2ae --- /dev/null +++ b/security/selinux/measure.c @@ -0,0 +1,204 @@ +static int selinux_hash_buffer(void *buf, size_t buf_len, +

Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-13 Thread Stephen Smalley
On 8/13/20 1:07 PM, Lakshmi Ramasubramanian wrote: SELinux configuration and policy are some of the critical data for this security module that needs to be measured. This measurement can be used by an attestation service, for instance, to verify if the configuration and policies have been setup

[PATCH 2/2] SELinux: Measure state and hash of policy using IMA

2020-08-13 Thread Lakshmi Ramasubramanian
SELinux configuration and policy are some of the critical data for this security module that needs to be measured. This measurement can be used by an attestation service, for instance, to verify if the configuration and policies have been setup correctly and that they haven't been tampered with at