IMA Policy Support for fs-verity: A Win-win for IMA & fs-verity
summary
Integrates fs‑verity digests and signatures into the IMA measurement list so IMA can appraise and enforce verity‑signed read‑only files without rereading full files, closes the page‑cache revalidation gap for ext4 f2fs and btrfs, and ships upstream in the recent kernel (file signatures land in rel nine and Fedora 37 will include them). Adds new templates (ima-ngv2, ima-sig-v2) and a signature format (sig v3) that embeds the fsverity digest plus hash algorithm; signing flows use fsveritydigest piped to evm utils and write to security.ima.
AI-written summary · about
chapters (4)
- 0:00Start
- 8:45IMA: initial policy design • Minimize system performance impact
- 12:06IMA: integrity gap
- 26:55Questions?
related talks
19mNFS Support for the Linux Integrity Measurement Architecture
28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space
19mSubsystem Update: Linux Integrity Status Update
36mOverview and Recent Developments: Linux Integrity
32mfs-verity: Native File-based Authenticity
35mIntegrity Measurements and the Cruel World
16mSub-system Update: Linux Integrity Status Update
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...