diff --git a/91-ignore-path-for-ima.md b/91-ignore-path-for-ima.md new file mode 100644 index 0000000..00bec46 --- /dev/null +++ b/91-ignore-path-for-ima.md @@ -0,0 +1,280 @@ + +# enhancement-91: Optional Path for IMA measurement + + + + + + +- [Release Signoff Checklist](#release-signoff-checklist) +- [Summary](#summary) +- [Motivation](#motivation) + - [Goals](#goals) + - [Non-Goals](#non-goals) +- [Proposal](#proposal) + - [User Stories (optional)](#user-stories-optional) + - [Story 1](#story-1) + - [Story 2](#story-2) + - [Notes/Constraints/Caveats (optional)](#notesconstraintscaveats-optional) + - [Risks and Mitigations](#risks-and-mitigations) +- [Design Details](#design-details) + - [Test Plan](#test-plan) + - [Upgrade / Downgrade Strategy](#upgrade--downgrade-strategy) +- [Drawbacks](#drawbacks) +- [Alternatives](#alternatives) +- [Infrastructure Needed (optional)](#infrastructure-needed-optional) + + +## Release Signoff Checklist + + + +- [ ] Enhancement issue in release milestone, which links to pull request in [keylime/enhancements] +- [ ] Core members have approved the issue with the label `in-progress` +- [ ] Design details are appropriately documented +- [ ] Test plan is in place +- [ ] User-facing documentation has been created in [keylime/keylime-docs] + + + +## Summary + + + +It may not always be evident to a user on what the final location of a file may +be when creating an allowlist. This enhancement proposes a new config value +that allows a user to work with both filenames with an arbitrary path, alongside +the current behavior of a full path set. + +## Motivation + + + +Some systems may have files that are in different locations depending on the +deployment. For example, a file `widgets` may be in `/opt/my_app` on one system +and `/usr/my_app` on another. This enhancement proposes a new config value that +allows a user to have keylime IMA ignore the path of a file if not present. + +This will especially be useful for users who want an application monitored by +keylime that may deploy to different systems with different paths. + +It would then allow an upstream project to generate signed allowlists that can +be used by downstream systems without having to modify the allowlist to set +deployment specific paths. + +However, those wanting the stronger guarantees of a full path set will still be +able to leverage that behavior. + +### Goals + + + +Allow users to only state a filename to be measured and not always the full +path. + +### Non-Goals + + + +## Proposal + + + +A bool config value `optional-paths` is introduced to the `keylime.conf` file. +When this value is set to `True`, if a file is without a leading POSIX path +then the file is still measured. If the file has a leading POSIX path separator +then the file is measured, as per the current behaviour, where the full path +dictates the comparision of the allowlist value to that recorded by IMA. + +### User Stories (optional) + + + +I have a system that has a file that may be situated in an arbitary location +depending on the deployment. I want to measure this file but I don't want to +have to specify the full path to the file. + +#### Story 1 + +#### Story 2 + +### Notes/Constraints/Caveats (optional) + + + +### Risks and Mitigations + + + +## Design Details + + + +The `optional-paths` value is added to the `keylime.conf` file. When this value is +set to `True`, the location of a file is ignored if no proceeding POSIX path is +specified. If a proceeding POSIX path is specified, the file is measured as per +the current behaviour. + +This will be set as False by default, meaning it is an opt-in feature. + +If a file is specified without a file path, alongside a duplicate filename with +a path, the file with the file path will be measured and the file without the +file path will be ignored. + +e.g. + +`as983o... widget` will be ignored if `as983o... /opt/my_app/widget` is present. + +### Test Plan + + + +### Upgrade / Downgrade Strategy + + + +### Dependencie requirements + + + +## Drawbacks + + + +## Alternatives + + + +## Infrastructure Needed (optional) + +