IMA Policy Support for fs-verity: A Win-win for IMA & fs-verity - Mimi Zohar, IBM
Channel: The Linux Foundation
Date: 08/08/2022

The original goals of the Linux Integrity subsystem - detect if files have been accidentally or maliciously altered, both remotely and locally, appraise a file's measurement against a "good" value stored as an extended attribute, and enforce local file integrity - based on a system wide policy have not changed, though new features have been added. One such feature is to verify "good" values stored as appended signatures. IMA support for including fs-verity file digests and signatures in the IMA measurement list, as well as verifying the fs-verity file digest based signatures, provides fs-verity with system wide policy support; and fs-verity closes an existing IMA integrity gap. This is a win-win scenario for fs-verity and IMA. This talk will describe the new fs-verity support, the IMA integrity gap closed by fs-verity, and if time permits other open integrity gaps.