security - Integrity Measurement Architecture(IMA) & Linux Extended Verification Module (EVM) -

i trying activate ima appraisal & evm modules.

after compiling linux kernel 3.10.2 on bt5r3 , setting kernel boot option in first time this:

grub_cmdline_linux="rootflags=i_version ima_tcb ima_appraise=fix ima_appraise_tcb evm=fix" 

and after running command generate xattr security.ima , security.evm

find / \( -fstype rootfs -o -fstype ext4 \) -type f -uid 0 -exec head -c 1 '{}' \; 

like this:

grub_cmdline_linux="rootflags=i_version ima_tcb ima_appraise=enforce ima_appraise_tcb evm=enforce" 

i try create digital signature of xattr it's recommended on tutorial tutorial ima & evm

every steps have been followed, creating rsa keys, loading them @ boot in initramfs keyctl.

session keyring        -3 --alswrv      0 65534  keyring: _uid_ses.0 977514165 --alswrv      0 65534   \_ keyring: _uid.0 572301790 --alswrv      0     0       \_ user: kmk-user 126316032 --alswrv      0     0       \_ encrypted: evm-key 570886575 --alswrv      0     0       \_ keyring: _ima 304346597 --alswrv      0     0       \_ keyring: _evm 

however reboot os when try read signed , hashed file error "permission denied" running dmesg tells me :

[ 5461.175996] type=1800 audit(1375262160.913:57): pid=1756 uid=0 auid=4294967295 ses=4294967295 op="appraise_data" cause="**invalid-hmac**" comm="sh" name="/root/desktop/new.sh" dev="sda1" ino=546526 res=0 

have idea why invalid hmac ? keys loaded tutorial says...

#!/bin/sh -e  prereq=""  # output pre-requisites prereqs() {         echo "$prereq" }  case "$1" in     prereqs)         prereqs         exit 0         ;; esac  grep -q "ima=off" /proc/cmdline && exit 1  mount -n -t securityfs securityfs /sys/kernel/security  ima_policy=/sys/kernel/security/ima/policy lsm_policy=/etc/ima_policy  grep -v "^#" $lsm_policy >$ima_policy  # import evm hmac key keyctl show |grep -q kmk || keyctl add user kmk "testing123" @u keyctl add encrypted evm-key "load `cat /etc/keys/evm-key`" @u #keyctl revoke kmk  # import module public key mod_id=`keyctl newring _module @u` evmctl import /etc/keys/pubkey_evm.pem $mod_id  # import ima public key ima_id=`keyctl newring _ima @u` evmctl import /etc/keys/pubkey_evm.pem $ima_id  # import evm public key evm_id=`keyctl newring _evm @u` evmctl import /etc/keys/pubkey_evm.pem $evm_id  # enable evm echo "1" > /sys/kernel/security/evm  # enable module checking #echo "1" > /sys/kernel/security/module_check 

thanks help

solved, new kernel use hmac v2 , have activate asymmetric key when compile kernel.

cat .config should have entries:

config_evm_hmac_version=2 config_asymmetric_key_type=y 

then when hash or sign file use

evmctl -u - -x --imasig/--imahash $file 

as should have create asymetric keys , load them in _evm , _ima keyring keyctl initramfs.