☰

Raspberry Pi의 IMA 측정에서는 `boot_aggregate`만

tag-icon • tag-icon linux raspberry-pi kernel
Raspberry Pi의 IMA 측정에서는 `boot_aggregate`만

Raspberry Pi 3B+에서 IMA(Integrity Measurement Architecture)를 사용하려고 합니다.

다음 옵션을 사용하여 커널을 컴파일했습니다( 로 구성 menuconfig).

CONFIG_IMA=y
CONFIG_IMA_MEASURE_PCR_IDX=10
# CONFIG_IMA_TEMPLATE is not set
CONFIG_IMA_NG_TEMPLATE=y
# CONFIG_IMA_SIG_TEMPLATE is not set
CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
# CONFIG_IMA_DEFAULT_HASH_SHA1 is not set
CONFIG_IMA_DEFAULT_HASH_SHA512=y
CONFIG_IMA_DEFAULT_HASH="sha512"
# CONFIG_IMA_WRITE_POLICY is not set
CONFIG_IMA_READ_POLICY=y
# CONFIG_IMA_APPRAISE is not set

CONFIG_INTEGRITY=y
# CONFIG_INTEGRITY_SIGNATURE is not set
CONFIG_INTEGRITY_AUDIT=y

ima_policy다음과 같이 설정하여 구성합니다 /boot/cmdline.txt.

console=serial0,115200 console=tty1 root=PARTUUID=8e9714d8-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait ima_policy=tcb ima_policy=appraise_tcb

Raspberry가 정상적으로 부팅되고 IMA sysfs 폴더에 액세스할 수 있습니다.

이 파일을 얻었습니다 /sysfs/kernel/security/ima/policy.

dont_measure fsmagic=0x9fa0 
dont_measure fsmagic=0x62656572 
dont_measure fsmagic=0x64626720 
dont_measure fsmagic=0x1021994 
dont_measure fsmagic=0x1cd1 
dont_measure fsmagic=0x42494e4d 
dont_measure fsmagic=0x73636673 
dont_measure fsmagic=0xf97cff8c 
dont_measure fsmagic=0x43415d53 
dont_measure fsmagic=0x27e0eb 
dont_measure fsmagic=0x63677270 
dont_measure fsmagic=0x6e736673 
dont_measure fsmagic=0xde5e81e4 
measure func=MMAP_CHECK mask=MAY_EXEC 
measure func=BPRM_CHECK mask=MAY_EXEC 
measure func=FILE_CHECK mask=^MAY_READ euid=0 
measure func=FILE_CHECK mask=^MAY_READ uid=0 
measure func=MODULE_CHECK 
measure func=FIRMWARE_CHECK 
measure func=POLICY_CHECK 
dont_appraise fsmagic=0x9fa0 
dont_appraise fsmagic=0x62656572 
dont_appraise fsmagic=0x64626720 
dont_appraise fsmagic=0x1021994 
dont_appraise fsmagic=0x858458f6 
dont_appraise fsmagic=0x1cd1 
dont_appraise fsmagic=0x42494e4d 
dont_appraise fsmagic=0x73636673 
dont_appraise fsmagic=0xf97cff8c 
dont_appraise fsmagic=0x43415d53 
dont_appraise fsmagic=0x6e736673 
dont_appraise fsmagic=0xde5e81e4 
dont_appraise fsmagic=0x27e0eb 
dont_appraise fsmagic=0x63677270 
appraise fowner=0

/sysfs/kernel/security/ima/ascii_runtime_measurements나는 또한 단 한 줄로 이것을 얻었습니다 .

10 45e7e585a82d311e1ee226b4256604c341dbc6b9 ima-ng sha512:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 boot_aggregate

내 문제는 내 Raspberry Pi가 어떤 파일도 측정하지 않는 것처럼 보이고 ascii_runtime_measurements측정값이 많은 파일을 원한다는 것입니다.

내가 뭘 잘못하고 있는지 아는 사람 있나요?

당신의 도움을 주셔서 감사합니다.

답변1

커널 문제일 수도 있습니다. iinit.c에서 이를 변경해 볼 수 있습니다. 나를 위해 일했습니다. 행운을 빌어요! 업데이트된 부분은 아래에서 처음이고 원본입니다. <

 static void init_once(void *foo)
 {
    struct integrity_iint_cache *iint = foo;
 
    memset(iint, 0, sizeof(*iint));
    iint->ima_file_status = INTEGRITY_UNKNOWN;
    iint->ima_mmap_status = INTEGRITY_UNKNOWN;
    iint->ima_bprm_status = INTEGRITY_UNKNOWN;
    iint->ima_read_status = INTEGRITY_UNKNOWN;
    iint->ima_creds_status = INTEGRITY_UNKNOWN;
    iint->evm_status = INTEGRITY_UNKNOWN;
    mutex_init(&iint->mutex);
 }
 
 
    if (!iint_cache)
    {
        iint_cache =
        kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
                  0, SLAB_PANIC, init_once);
    }
 
 



static void init_once(void *foo)
 {
    struct integrity_iint_cache *iint = foo;
 
    memset(iint, 0, sizeof(*iint));
    iint->ima_file_status = INTEGRITY_UNKNOWN;
    iint->ima_mmap_status = INTEGRITY_UNKNOWN;
    iint->ima_bprm_status = INTEGRITY_UNKNOWN;
    iint->ima_read_status = INTEGRITY_UNKNOWN;
    iint->ima_creds_status = INTEGRITY_UNKNOWN;
    iint->evm_status = INTEGRITY_UNKNOWN;
    mutex_init(&iint->mutex);
 }

관련 정보