1 What: /sys/kernel/security/evm !! 1 What: security/evm
2 What: /sys/kernel/security/*/evm <<
3 Date: March 2011 2 Date: March 2011
4 Contact: Mimi Zohar <zohar@us.ibm.com> 3 Contact: Mimi Zohar <zohar@us.ibm.com>
5 Description: 4 Description:
6 EVM protects a file's security 5 EVM protects a file's security extended attributes(xattrs)
7 against integrity attacks. The 6 against integrity attacks. The initial method maintains an
8 HMAC-sha1 value across the ext 7 HMAC-sha1 value across the extended attributes, storing the
9 value as the extended attribut 8 value as the extended attribute 'security.evm'.
10 9
11 EVM supports two classes of se 10 EVM supports two classes of security.evm. The first is
12 an HMAC-sha1 generated locally 11 an HMAC-sha1 generated locally with a
13 trusted/encrypted key stored i 12 trusted/encrypted key stored in the Kernel Key
14 Retention System. The second i 13 Retention System. The second is a digital signature
15 generated either locally or re 14 generated either locally or remotely using an
16 asymmetric key. These keys are 15 asymmetric key. These keys are loaded onto root's
17 keyring using keyctl, and EVM 16 keyring using keyctl, and EVM is then enabled by
18 echoing a value to <securityfs !! 17 echoing a value to <securityfs>/evm:
19 following bits: <<
20 18
21 === ==================== !! 19 1: enable HMAC validation and creation
22 Bit Effect !! 20 2: enable digital signature validation
23 === ==================== !! 21 3: enable HMAC and digital signature validation and HMAC
24 0 Enable HMAC validati !! 22 creation
25 1 Enable digital signa !! 23
26 2 Permit modification !! 24 Further writes will be blocked if HMAC support is enabled or
27 runtime. Not support !! 25 if bit 32 is set:
28 creation is enabled !! 26
29 31 Disable further runt !! 27 echo 0x80000002 ><securityfs>/evm
30 === ==================== !! 28
>> 29 will enable digital signature validation and block
>> 30 further writes to <securityfs>/evm.
>> 31
>> 32 Until this is done, EVM can not create or validate the
>> 33 'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
>> 34 Loading keys and signaling EVM should be done as early
>> 35 as possible. Normally this is done in the initramfs,
>> 36 which has already been measured as part of the trusted
>> 37 boot. For more information on creating and loading
>> 38 existing trusted/encrypted keys, refer to:
31 39
32 For example:: !! 40 Documentation/security/keys/trusted-encrypted.rst. Both dracut
33 !! 41 (via 97masterkey and 98integrity) and systemd (via
34 echo 1 ><securityfs>/evm <<
35 <<
36 will enable HMAC validation an <<
37 <<
38 :: <<
39 <<
40 echo 0x80000003 ><securityfs <<
41 <<
42 will enable HMAC and digital s <<
43 HMAC creation and disable all <<
44 <<
45 :: <<
46 <<
47 echo 0x80000006 ><securityfs <<
48 <<
49 will enable digital signature <<
50 modification of EVM-protected <<
51 disable all further modificati <<
52 deprecated in favor of:: <<
53 <<
54 echo 0x80000002 ><securityfs <<
55 <<
56 as the outstanding issues that <<
57 signatures have been solved. <<
58 <<
59 Echoing a value is additive, t <<
60 existing initialization flags. <<
61 <<
62 For example, after:: <<
63 <<
64 echo 2 ><securityfs>/evm <<
65 <<
66 another echo can be performed: <<
67 <<
68 echo 1 ><securityfs>/evm <<
69 <<
70 and the resulting value will b <<
71 <<
72 Note that once an HMAC key has <<
73 be possible to enable metadata <<
74 HMAC key has been loaded will <<
75 For example, if the current va <<
76 <<
77 echo 1 ><securityfs>/evm <<
78 <<
79 will set the new value to 3 (4 <<
80 <<
81 Loading an HMAC key is the onl <<
82 modification. <<
83 <<
84 Until key loading has been sig <<
85 or validate the 'security.evm' <<
86 INTEGRITY_UNKNOWN. Loading ke <<
87 should be done as early as pos <<
88 done in the initramfs, which h <<
89 as part of the trusted boot. <<
90 creating and loading existing <<
91 refer to: <<
92 Documentation/security/keys/tr <<
93 dracut (via 97masterkey and 98 <<
94 core/ima-setup) have support f 42 core/ima-setup) have support for loading keys at boot
95 time. 43 time.
96 <<
97 What: /sys/kernel/security/*/evm/evm <<
98 Date: April 2018 <<
99 Contact: Matthew Garrett <mjg59@google.c <<
100 Description: <<
101 Shows the set of extended attr <<
102 validate the EVM signature, an <<
103 to be added at runtime. Any si <<
104 additional attributes are adde <<
105 additional attributes) will on <<
106 additional attributes are conf <<
107 a single period (.) will lock <<
108 modification. <<
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.