{"id":113980,"date":"2024-02-29T18:25:59","date_gmt":"2024-02-29T16:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux"},"modified":"2024-02-29T18:25:59","modified_gmt":"2024-02-29T16:25:59","slug":"microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/microsoft-predlozhil-sistemu-upravleniya-dostupom-ipe-dlya-yadra-linux","title":{"rendered":"Microsoft proposed an IPE access management system for the Linux kernel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The company has submitted for discussion in the Linux kernel developers' mailing list the code of the LSM module implementing the IPE (Integrity Policy Enforcement) mechanism, which extends existing mandatory access control systems. Instead of being tied to labels and paths, in IPE the decision to allow or deny an operation is based on the constant properties of the system component with which the operation is performed. The module allows for the definition of an overall integrity policy for the entire system, indicating which operations are permissible and how to verify the authenticity of components. <\/p>\n
IPE aims to create fully verifiable systems, whose integrity is confirmed from the initial bootloader and kernel to the final executable files, configurations, and loaded files. For example, IPE can specify which executable files are allowed to run, considering their compliance with a reference version using cryptographic hashes provided by the dm-verity system. In the event of a file being changed or replaced, IPE can block the operation or log the integrity violation. <\/p>\n
The proposed mechanism can be applied in firmware for embedded devices, where all software and settings are specially assembled and provided by the owner. For instance, Microsoft IPE is used in datacenter equipment for firewalls. Unlike other integrity verification systems such as IMA, IPE is independent of metadata in the filesystem \u2014 all properties defining the permissibility of operations are stored directly in the kernel. <\/p>\n
Rules are defined in text form using key-value pairs. The basic keys are 'op', which defines the operation to which the rule applies (for example, op=EXECUTE will trigger on an execution attempt), and 'action', which defines the action (for example, 'action=DENY' for blocking). Rules are tied to properties provided by external subsystems such as dm-verity and fs-verity. <\/p>\n
For example, the rules op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=FALSE action=DENY op=EXECUTE fsverity_digest=sha256:401fce\u20260dec146938 action=DENY will allow only booting from a verified partition, block the execution of files from partitions that do not have signatures in dm-verity, and selectively deny the execution of a file with the hash '401fce\u20260dec146938'. <\/p>\n
The initial set of boot rules is defined using the SECURITY_IPE_BOOT_POLICY setting and is included in the kernel build, while additional rules are added as needed via the file \/sys\/kernel\/security\/ipe\/new_policy. The rules provided are encrypted using the certificate defined in SYSTEM_TRUSTED_KEYRING. <\/p>\n
In general-purpose systems, it is recommended to apply IPE in conjunction with the DIGLIM mechanism developed by Huawei. DIGLIM is implemented using eBPF and allows for easy integrity checks at the file level in standard distributions without requiring their redesign (presented as a Secure Boot variant that operates at the application level). The essence of DIGLIM is to maintain a pool of checksum verifications for files and metadata, providing access to executable files only if their hash is present in the pool. The list of hashes can be obtained from the RPM package manager or manually generated by the user. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"