A Canonical Event Log Structure for IMA
summary
Proposes a canonical TLV event-log that adds sequence-numbered TLV records and TCG algorithm agility so PCR banks (e.g., PCR 10) and multiple hashes coexist; provides utilities to convert legacy PCR/IMA templates and a kernel config option to emit TLV. Prototype moves the measurement list to user space, removes an in-kernel memory leak, attests file metadata (owner/group/mode, setuid), and validates final PCR values; implementation is small (480 LOC TLV parser vs ~1,700 template code) and runs stable for days.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 3:54Issues in attestation
- 8:45Record Number
- 11:53TCG Architecture
- 15:26ContentType
- 17:13CEO Management
- 19:19Workflow
- 20:34Proposal
- 24:58Exporting
- 26:26Refactoring
- 27:32Proof of Concept
- 27:54Adding Fields
- 28:48Running
- 33:16Summary
- 36:14Time stamps
related talks
42mSnapshotting IMA Log
29mIMA Namespaces for Containers
47mNamespacing the Linux Integrity Measurement Architecture
28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space
42mTPM based attestation - how can we use it for good?
36mOverview and Recent Developments: Linux Integrity
31mThe Digest_cache LSM
35mIntegrity Measurements and the Cruel World