Snapshotting IMA Log
Talkat Linux Security Summit North America 2024 · on Friday, 2024-04-19· at 11:10· Terrace Suite 1+2·
summary
Proposal adds kernel IMA log snapshotting so the kernel can emit a snapshot aggregate event, user space copies the archived binary snapshots to a configured on disk location and then signals the kernel to truncate the in memory IMA log, reducing kernel and userland memory pressure on long running servers. Server verifiers must accept multiple snapshot files plus the current in memory log so attestation becomes stateful rather than a single monolithic replay. A working prototype demonstrates copy then truncate, but kernel support is not yet upstream.
AI-written summary · about
chapters (12)
- 0:00IMA log snapshotting intro
- 2:06Remote attestation basics
- 4:58Motivation for snapshotting
- 8:54Memory pressure on devices
- 10:18Design considerations
- 15:21Snapshot triggers
- 17:52Aggregate marker events
- 20:21Server-side processing
- 26:34Kernel vs user mode
- 28:21Live demo
- 32:23Community feedback
- 35:21Q&A
related talks
28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space
35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verity
41mA Canonical Event Log Structure for IMA
19mSubsystem Update: Linux Integrity Status Update
35mIntegrity Measurements and the Cruel World
47mNamespacing the Linux Integrity Measurement Architecture
19mNFS Support for the Linux Integrity Measurement Architecture
21m(Ab)using Linux as a Trusted Bootloader