<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi, everyone</p>
<p><br>
</p>
<p>Now I'm testing ima-evm security module to see if it can be
applied my embedded system board. (not using TPM)</p>
<p>The kernel version is 5.4.91 (based on beaglebone black board).<br>
</p>
<p>But, unfortunately I cannot verify the functions of ima-evm
correctly.</p>
<p>When I apply "appraise", kernel panic happens.</p>
<p>This is what happened:<br>
</p>
<p><br>
</p>
<p>(1) I set ima-evm keys as follows :</p>
<p> # dd if=/dev/urandom bs=1 count=32 status=none | keyctl padd
user kmk-user @u</p>
<p> # keyctl link @u @s</p>
<p> #keyctl pipe `key search @u user kmk-user` >
/etc/keys/kmk-user.blob</p>
<p> #keycl add encrypted evm-key "new user:kmk-user 32" @u</p>
<p> #keyctl pipe `keyctl search @u encrypted evm-key` >
/etc/keys/evm-user.blob</p>
<p> # openssl genrsa -out /etc/keys/rsa_private.pem 1024</p>
<p> # openssl rsa -pubout -in /etc/keys/rsa_private.pem -out
/etc/keys/rsa_public.pem</p>
<p>(2) I set kernel parameters with <b>"ima_policy=appraise_tcb
ima_appraise=fix evm=fix"</b></p>
<p>(3) After boot, I loaded the keys lik this:</p>
<p> # keyctl add user kmk-user "`cat /etc/keys/kmk-user.blob`" @u<br>
# keyctl link @u @s<br>
# keyctl add encrypted evm-key "load `cat
/etc/keys/evm-user.blob`" @u<br>
# evmctl import --rsa /etc/keys/rsa_public.pem $(keyctl
newring _ima @u)<br>
# evmctl import --rsa /etc/keys/rsa_public.pem $(keyctl
newring _evm @u)<br>
# echo 1 > /sys/kernel/security/evm</p>
<p>(4) I created the ima-evm digital signatures :</p>
<p> # find / -type f -exec evmctl ima_sign --key
/etc/keys/rsa_private.pem '{}' \;</p>
<p>(5) I changed the kernel parameter as this : <b>"ima_policy=appraise_tcb
ima_appraise=enforce"</b></p>
<p>(6) When the board reboot, it stop because of kernel panic :</p>
<p><b>[ 3.546536] audit: type=1800 audit(946688023.636:2): pid=1
uid=0 auid=4294967295 ses=4294967295 subj==unconfined
op=appraise_data cause=unknown comm="swapper"
name="/lib/systemd/systemd" dev="mmcblk0p1" ino=5684 res=0</b></p>
<p><br>
</p>
<p>When the kernel parameter is "ima_policy=tcb
ima_appraise=enforce", kernel panic does not happen, but after
boot, any executable file is not blocked although its contents is
changed.<br>
</p>
<p>Please give me an advice.</p>
<p>Thanks in advance,</p>
<p>J.Hwan Kim<br>
</p>
<br>
</body>
</html>