NFS Support for the Linux Integrity Measurement Architecture

on YouTube ↗19m

" summary

Adds a new NFSv4 attribute FATTR for IMA so servers can store opaque IMA metadata blobs, provides a prototype client and server implementation for Linux NFS server and client, and publishes a working-group draft toward an RFC. Protocol moves signature-verified checksums alongside file content, relies on optional Kerberos integrity for in-transit protection, and leaves unresolved how to authorize server-side modification of IMA blobs. Does not attempt NFS boot secure‑boot or attribute-level EVM checksum protection.

AI-written summary · about

" chapters (8)

1. 0:00NFS Support for the Linux Integrity Measurement Architecture Chuck Lever, Oracle Corporation
2. 3:50Some storage servers do not have a user execution environment (e.g., filers) Storage servers and clients may run different operating systems with different semantics • Filesystems on storage server may not support Linux-style extended attributes
3. 6:13Extend envelope of protection from NFS server to end users on NFS clients • Enable installation of IMA-protected executables from NFS clients Enable appraisal policy on an NFS client to be different than its peers or the policy on the NFS server
4. 8:15transport via NFS - Corruption of IMA metadata is detected when signature is verified - Corruption of file content is detected when it is appraised
5. 9:13supported by NFS protocol - NFSv4 ACLs are not the same as POSIX ACLS - NFS protocol would need to expose the list of protected attributes and FS UUID
6. 13:12How do we decide if the specified extension is effective complete? - When will prototype implementation be ready to merge upstream? • Is performance a consideration? • Is IMA offload an interesting use case?
7. 14:43Whine about legacy technologies! - Kerberized NFS, NFSv4 ID mapping and ACLS Throw tomatoes at new topics! - NFS support for capabilities and other LSM
8. 15:15LINUX SECURITY SUMMIT

" related talks

• 35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verityMimi Zohar · Linux Security Summit North America 2022
• 47mNamespacing the Linux Integrity Measurement ArchitectureChristian Brauner, Stefan Berger · Linux Security Summit North America 2022
• 36mOverview and Recent Developments: Linux IntegrityMimi Zohar · Linux Security Summit Europe 2018
• 28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User SpaceRoberto Sassu · Linux Security Summit Europe 2025
• 35mUsing Linux as a Secure Boot Loader for OpenPOWER ServersNayna Jain, Thiago Jung Bauermann · Linux Security Summit Europe 2018
• 29mIMA Namespaces for ContainersAsier Gutierrez · Open Source Summit Europe 2023
• 16mSub-system Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2018
• 26mIntegrityMimi Zohar · Linux Security Summit 2016