Project:Integrity
| Integrity, Compliance, and Reporting | |
|---|---|
| Description | The integrity subproject aims to integrate and maintain technologies related to system integrity within Gentoo Hardened. Although initially focused on Linux IMA/EVM, this will extend towards other integrity, compliance and reporting technologies. |
| Project email | integrity@gentoo.org |
| IRC channel | #gentoo-hardened (webchat) |
| Lead(s) |
Last elected: 2019-04-29 |
| Member(s) | |
| Subproject(s) (and inherited member(s)) |
(none) |
| Parent Project | Hardened |
| Project listing | |
This project will support the Linux IMA/EVM technology within Gentoo Linux, as well as other integrity-related technologies together with compliance and reporting specific technologies. It will support the necessary kernel patches, utilities and documentation to make integrity checks, compliance and reporting available to the wider public. The primary focus is to prevent tampering of files, settings and images: when this occurs, the boot-up of the system detects the tampering and refuses to load further (or report this to the administrator). Online tampering detection is a second step.
Next to the integrity subsystem within Linux (IMA/EVM), this project will also support the various trusted computing technologies (such as TPM support) through well-documented guides and tools.
Goals
The main goal of this project is to support all integrity-related technologies in Gentoo Linux, offering good integration, tools and documentation to help users in setting up a more secure, managed environment, fully in line with the Gentoo Hardened vision.
What is IMA/EVM?
Integrity Measurement Architecture
IMA, or Integrity Measurement Architecture, is a Linux kernel integrity subsystem which aims to detect if files have been altered. It supports the collection of file integrity data (hashing), storage of the integrity values both locally (in extended attributes) and through TPM (Trusted Platform Module) protection. If a TPM is present, it can sign these integrity results so that interested parties can attest that the system has not been tampered with.
A fourth function, called "appraisal", has recently been accepted in the main Linux kernel. This function allows local validation of the integrity value against a known good value.
Extended Verification Module
While IMA provides a layer of protection against tampering of file content, EVM (Extended Verification Module) provides protection against tampering of file metadata (more specifically the security extended attributes). And as IMA stores the integrity values of the files in such extended attributes, it makes sense to properly protect these too.
Resources
Resources offered or also supported by the Integrity project are:
- Concepts and Introduction to Integrity
- Using Integrity Measurement Architecture in Gentoo Linux
- Using Extended Verification Module in Gentoo Linux
- Signed kernel module support
- Advanced Intrusion Detection Environment (AIDE)
- DM-Crypt (Device mapper with crypt target, using LUKS)
External resources
The following resources are not in our control but are important resources:
Participation
To participate in the Integrity project first join the mailing list at gentoo-hardened@gentoo.org and, if you can, visit our IRC channel at #gentoo-hardened (webchat) on Libera.Chat.
As this project is brand new, there are still lots of fields to contribute in: supporting the IMA patches, documentation, TPM and trusted computing support in general, etc.