integrity(7)

INTEGRITY(7)

IMA and EVM

INTEGRITY(7)

NAME

ima-evm-integrity - IMA and EVM system integrity control

SYNOPSIS

integrity-applier

integrity-remover

DESCRIPTION

Basic usage:

1. Run integrity-applier command. The system reloads to so-called Stage II with ima_appraise=fix kernel option.
2. Run integrity-applier command again to sign the files. Use --cert and --key command-line options to sign files with user-defined keys (use -B BASENAME | --basename=BASENAME option to install the given user-defined certificate file under non-default filename). After the sign procedure is done the system reloads to IMA enforced mode (i. e. with ima_appraise=enforce kernel command-line option).
3. In order to disable IMA, run the integrity-remover script.

By default the file signing log is written to /var/log/integrity-sign.log.

The trusted IMA keyring

In order to use the trusted IMA keyring select keyring name ".ima" using the IMA_KEYRING=.ima configuration option in the /etc/integrity/config file. The secondary trusted keyring certificates can be configured with the SECONDARY_SUFFIX configuration option.

Note that in order to make the IMA trusted keyring available the kernel needs to be compiled with CONFIG_INTEGRITY_TRUSTED_KEYRING=y and CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y options set.

Advanced usage of the integrity-applier utility:

* Use --log=FILE option to output file signing log to specified FILE at Stage II. Use --log-stderr option to get it output to the current error stream.
* Use --init and --sign to explicitly select Stage I or Stage II.
* Use -R | --no-reboot to suppress automatic reboot of the system.
* Use -a HASH | --hash=HASH option to select the type of cryptographic hash function to sign the files with. It can also be configured in /etc/sysconfig/integrity (and/or /etc/sysconfig/integrity).
* Use -r | --resign option together with --cert and --key options to overwrite existing IMA and EVM signatures.
* Use -B BASENAME | --basename=BASENAME option to specify the base name of the certificate file that is installed in /etc/keys/ (see also the CERT_BASENAME configuration option).
* Use -A | --auto option to automatically run Stage II after reboot using the special ima-signing.target.
* Visit /etc/integrity/config and /etc/sysconfig/integrity to configure the directories with files to sign and other options, such as EVM. Contents of /etc/sysconfig/integrity override values set in /etc/integrity/config.
* Enable ima-check.service to check IMA policy at system boot. Add services to ima-check-failed.target to run actions when the check fails.
* Touch /etc/integrity/reboot-on-initrd-error in order not to load the system at all if loading of IMA policy fails at initrd stage. Also, use /etc/integrity/on-initrd-error script to run it instead of reboot.
* Override the default integrity policy with /etc/integrity/policy.

CONFIGURATION FILE

Options to configure in the /etc/integrity/config and /etc/sysconfig/integrity configuration files are as follows:

* HASH_ALGO -- select one of the supported hash algorithms: sha512, streebog256 and streebog512;
* GOST_PARAMSET -- a default GOST param-set ("paramset:A") can be overriden;
* LIBDIRS -- space-separated paths to search for library (.so) files;
* EXECLIBDIRS -- space-separated paths to additional executable files;
* LIB_EXT -- select suffices for additional files to sign (searched in /var/lib/ and LIBDIRS, a space-separated list);
* LOG_FILE -- define path to log file (the default is /var/log/integrity-sign.log);
* IMA_KEYRING -- set to ".ima" in order to use the trusted keyring;
* CERT_BASENAME -- select the base name of the certificate file that is installed in the /etc/keys/ directory (the default is x509, can also be specified on the command-line with the -B BASENAME | --basename=BASENAME option);
* SECONDARY_SUFFIX -- select suffix for intermediate authority certificate files to load into the secondary trusted kernel keyring (the default is "_ca");
* PROTECT_KEYS -- set to nonzero in order to protect the keys form removal (may not work with the trusted keyrings);
* PROTECT_KEYRINGS -- set to nonzero in order to protect the keyring itself from key removal (may not work with the trusted keyrings);
* WITH_EVM -- set to nonempty value in order to enable EVM; Use a hex value (i. e.: 0x...) to specify the EVM mode;
* CERT -- path to a user-defined certificate (it's better to use the --cert command-line option);
* PRIVKEY -- path to a user-defined private key (it's better to use the --key command-line option).
* RESIGN -- set to nonempty value in order to overwrite existing IMA and EVM signatures.

BUGS

Report bugs to https://bugzilla.altlinux.org/.

COPYRIGHT

Copyright © BaseALT, Ltd. License GPLv2+: GNU GPL version 2 or later See <http://gnu.org/licenses/gpl.html> for more information.
This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.