1 What: /sys/kernel/security/evm 1 What: /sys/kernel/security/evm
2 What: /sys/kernel/security/*/evm 2 What: /sys/kernel/security/*/evm
3 Date: March 2011 3 Date: March 2011
4 Contact: Mimi Zohar <zohar@us.ibm.com> 4 Contact: Mimi Zohar <zohar@us.ibm.com>
5 Description: 5 Description:
6 EVM protects a file's security 6 EVM protects a file's security extended attributes(xattrs)
7 against integrity attacks. The 7 against integrity attacks. The initial method maintains an
8 HMAC-sha1 value across the ext 8 HMAC-sha1 value across the extended attributes, storing the
9 value as the extended attribut 9 value as the extended attribute 'security.evm'.
10 10
11 EVM supports two classes of se 11 EVM supports two classes of security.evm. The first is
12 an HMAC-sha1 generated locally 12 an HMAC-sha1 generated locally with a
13 trusted/encrypted key stored i 13 trusted/encrypted key stored in the Kernel Key
14 Retention System. The second i 14 Retention System. The second is a digital signature
15 generated either locally or re 15 generated either locally or remotely using an
16 asymmetric key. These keys are 16 asymmetric key. These keys are loaded onto root's
17 keyring using keyctl, and EVM 17 keyring using keyctl, and EVM is then enabled by
18 echoing a value to <securityfs 18 echoing a value to <securityfs>/evm made up of the
19 following bits: 19 following bits:
20 20
21 === ==================== 21 === ==================================================
22 Bit Effect 22 Bit Effect
23 === ==================== 23 === ==================================================
24 0 Enable HMAC validati 24 0 Enable HMAC validation and creation
25 1 Enable digital signa 25 1 Enable digital signature validation
26 2 Permit modification 26 2 Permit modification of EVM-protected metadata at
27 runtime. Not support 27 runtime. Not supported if HMAC validation and
28 creation is enabled 28 creation is enabled (deprecated).
29 31 Disable further runt 29 31 Disable further runtime modification of EVM policy
30 === ==================== 30 === ==================================================
31 31
32 For example:: 32 For example::
33 33
34 echo 1 ><securityfs>/evm 34 echo 1 ><securityfs>/evm
35 35
36 will enable HMAC validation an 36 will enable HMAC validation and creation
37 37
38 :: 38 ::
39 39
40 echo 0x80000003 ><securityfs 40 echo 0x80000003 ><securityfs>/evm
41 41
42 will enable HMAC and digital s 42 will enable HMAC and digital signature validation and
43 HMAC creation and disable all 43 HMAC creation and disable all further modification of policy.
44 44
45 :: 45 ::
46 46
47 echo 0x80000006 ><securityfs 47 echo 0x80000006 ><securityfs>/evm
48 48
49 will enable digital signature 49 will enable digital signature validation, permit
50 modification of EVM-protected 50 modification of EVM-protected metadata and
51 disable all further modificati 51 disable all further modification of policy. This option is now
52 deprecated in favor of:: 52 deprecated in favor of::
53 53
54 echo 0x80000002 ><securityfs 54 echo 0x80000002 ><securityfs>/evm
55 55
56 as the outstanding issues that 56 as the outstanding issues that prevent the usage of EVM portable
57 signatures have been solved. 57 signatures have been solved.
58 58
59 Echoing a value is additive, t 59 Echoing a value is additive, the new value is added to the
60 existing initialization flags. 60 existing initialization flags.
61 61
62 For example, after:: 62 For example, after::
63 63
64 echo 2 ><securityfs>/evm 64 echo 2 ><securityfs>/evm
65 65
66 another echo can be performed: 66 another echo can be performed::
67 67
68 echo 1 ><securityfs>/evm 68 echo 1 ><securityfs>/evm
69 69
70 and the resulting value will b 70 and the resulting value will be 3.
71 71
72 Note that once an HMAC key has 72 Note that once an HMAC key has been loaded, it will no longer
73 be possible to enable metadata 73 be possible to enable metadata modification. Signaling that an
74 HMAC key has been loaded will 74 HMAC key has been loaded will clear the corresponding flag.
75 For example, if the current va 75 For example, if the current value is 6 (2 and 4 set)::
76 76
77 echo 1 ><securityfs>/evm 77 echo 1 ><securityfs>/evm
78 78
79 will set the new value to 3 (4 79 will set the new value to 3 (4 cleared).
80 80
81 Loading an HMAC key is the onl 81 Loading an HMAC key is the only way to disable metadata
82 modification. 82 modification.
83 83
84 Until key loading has been sig 84 Until key loading has been signaled EVM can not create
85 or validate the 'security.evm' 85 or validate the 'security.evm' xattr, but returns
86 INTEGRITY_UNKNOWN. Loading ke 86 INTEGRITY_UNKNOWN. Loading keys and signaling EVM
87 should be done as early as pos 87 should be done as early as possible. Normally this is
88 done in the initramfs, which h 88 done in the initramfs, which has already been measured
89 as part of the trusted boot. 89 as part of the trusted boot. For more information on
90 creating and loading existing 90 creating and loading existing trusted/encrypted keys,
91 refer to: 91 refer to:
92 Documentation/security/keys/tr 92 Documentation/security/keys/trusted-encrypted.rst. Both
93 dracut (via 97masterkey and 98 93 dracut (via 97masterkey and 98integrity) and systemd (via
94 core/ima-setup) have support f 94 core/ima-setup) have support for loading keys at boot
95 time. 95 time.
96 96
97 What: /sys/kernel/security/*/evm/evm 97 What: /sys/kernel/security/*/evm/evm_xattrs
98 Date: April 2018 98 Date: April 2018
99 Contact: Matthew Garrett <mjg59@google.c 99 Contact: Matthew Garrett <mjg59@google.com>
100 Description: 100 Description:
101 Shows the set of extended attr 101 Shows the set of extended attributes used to calculate or
102 validate the EVM signature, an 102 validate the EVM signature, and allows additional attributes
103 to be added at runtime. Any si 103 to be added at runtime. Any signatures generated after
104 additional attributes are adde 104 additional attributes are added (and on files possessing those
105 additional attributes) will on 105 additional attributes) will only be valid if the same
106 additional attributes are conf 106 additional attributes are configured on system boot. Writing
107 a single period (.) will lock 107 a single period (.) will lock the xattr list from any further
108 modification. 108 modification.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.