第 24 章 Extending, customizing, and troubleshooting kernel integrity subsystem

Procedure

1. Install the rpm-plugin-ima:

   $ sudo dnf install rpm-plugin-ima -yq

   This ensures that package files have IMA signature stored in security.xattr automatically during package installation, reinstallation, or upgradation.

2. Reinstall all the packages:

   $ sudo dnf reinstall "*" -y

   This ensures that the security.xattr extended attribute is updated for all packages.

3. Enable the dracut integrity module so the official IMA code-signing key in /etc/keys/ima loads automatically on boot:

   $ sudo dracut -f

Procedure

1. Optional: Enable your chosen IMA-appraisal policy or skip this step if you only use your custom policy. Take built-in ima_policy=appraise_tcb as an example:

   # grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="ima_policy=appraise_tcb"

   • Additionally for s390x systems:

     # zipl

2. Enable IMA-appraisal fix mode by adding the ima_appraise=fix kernel command line parameter:

   # grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="ima_appraise=fix"

   • Additionally for s390x systems:

     # zipl

3. Reboot the system:

   # reboot

4. Optional: Load your custom IMA policy:

   # echo <path_to_your_custom_ima_policy> > /sys/kernel/security/ima/policy

5. Re-label the whole system:

   # find / -fstype xfs -type f -uid 0 -exec head -c 0 '{}' \;

6. Turn off IMA-appraisal fix mode by removing the ima_appraise=fix kernel command line parameter:

   # grubby --update-kernel=/boot/vmlinuz-$(uname -r) --remove-args="ima_appraise=fix"

   • Additionally for s390x systems:

     # zipl

7. Enable the secure boot if it is disabled.