Re: [nfsv4] Fwd: I-D Action: draft-ietf-nfsv4-integrity-measurement-03.txt

[Chuck Lever <[e-mail]>]

> On Nov 8, 2018, at 12:03 PM, Everhart, Craig <[e-mail]> wrote:
> 
> Hi Chuck, just one point.
> 
> On 11/8/18, 11:54 AM, "Chuck Lever" <[e-mail]> wrote:
> 
>>   This means _any_ change
>>   to the content between the time it is generated and the time it
>>   is used can be detected.
>> 
>> And detected by only these special tools.
> 
>    No, the FPI is evaluated by the provenance assessor before each
>    access of the file.
> 
> Perhaps you could clarify this architecture.  The menagerie of tools that would be modified, this provenance assessor--what is the architecture of the system in which these tools exist?  Is the "provenance assessor" part of the presumed OS on the NFS client?

We're going in circles now. I've explained this before in e-mail
and in the document.


> Is it active when I read a file with the menagerie (e.g., "cp")?

Depending on policy, it can be.


> At backup time?

Depending on policy, it can be.

The primary point of FPI is to prevent the use of corrupted file
contents. Copying or backing up file content is not necessarily
considered "use", but an administrator might be paranoid or want
some notification if tampering has occurred long before a file
is used. It's also possible that a tool can be constructed to
scrub a file system to pre-emptively identify corrupted content.

Again, this document is not meant to be a full specification of
IMA and how it's used. A discussion of tooling is out of scope,
IMO.


> I assume that it will be active when I want to edit the content of a source file, or execute a binary executable file.

Most certainly just before a file is executed. If a source file
is protected, it will be assessed as it is opened but before its
contents are presented via read(2) or mmap(2). Any edits will
require that the FPI be refreshed once the file content is stable
again.

So, now that I'm paged in again, I do want to have multiple FPI
blobs per file. IMA has one for file content, and another one
for file attributes (the EVM blob). Both can exist at the same
time. I'm specifying only the IMA blob for NFS at this time, as
explained in a prior email, but you should assume that more blobs
will be coming in the future.


--
Chuck Lever