Gotcha

Sometimes event logs are not enough, and you need to supply your security systems with something more. For instance, you might want to improve the detection of anomalies or facilitate the hunt for an intruder on your network. Many commercial solutions are available for file integrity monitoring in Linux. However, some budgets don't allow for a large investment. The good news is that Linux systems have a great selection of open source tools for securing systems, and these tools provide a means for maintaining file integrity at low cost. The Integrity Measurement Architecture comes in handy.

Integrity Measurement Architecture (IMA) [1] is a component of the Linux kernel's integrity subsystem (see the "Components of the Integrity Subsystem" box.) IMA is responsible for calculating hashes of files before loading them, and it supports reporting on the hashes. The integrity subsystem also consists of an Extended Verification Module (EVM) that detects tampering with offline security attribute extensions (e.g., SELinux), which are the basis for clearance decisions of the Linux Security Modules (LSM) framework.

What Is IMA?

The main purpose of IMA is to detect if files have been accidentally or intentionally changed, evaluate the measurement of a file against a value stored as an extension attribute, and enforce the integrity of local files. These objectives are complemented by Mandatory Access Control (MAC) protections provided by LSM modules such as SELinux and Smack.

To ensure file integrity, IMA can work with the Trusted Platform Module (TPM) chip [2] to protect the collected hashes from tampering.

IMA provides the following functions:

• Collect – measure a file before it is accessed.
• Store – add the measurement to a kernel resident list, and if a hardware TPM is present, extend the IMA PCR.
• Attest – use the TPM (if it is present) to sign the IMA PCR value, allowing a remote validation of the measurement list.
• Appraise – enforce local validation of a measurement against a known value stored in an extended attribute of the file.
• Protect – protect a file's security/extended attributes (including appraisal hash) against offline attack.
• Audit – audit the file hashes.

Enabling IMA

The first step for enabling IMA is to open and replace some lines in the kernel configuration file. Listing 1 shows an example of the changes for kernel version 4.15.0.

$ vi /boot/config-4.15.0-126-generic
CONFIG_INTEGRITY=y
CONFIG_IMA=y
CONFIG_IMA_MEASURE_PCR_IDX=10
CONFIG_IMA_LSM_RULES=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_IMA_APPRAISE=y
--
# Since 4.13
IMA_APPRAISE_BOOTPARAM=y
--

The next step is to update the bootloader configuration. Add the following line to the /etc/default/grub file:

GRUB_CMDLINE_LINUX="ima_tcb lsm=integrity ima_appraise=enforce ima_policy=tcb ima_policy=appraise_tcb ima_hash=sha256"

lsm=integrity enables integration with LSM, and ima_appraise = enforce causes IMA to evaluate files according to policy.

Update Grub with:

$ sudo update-grub

The integrity log registered by IMA is located in the directory /sys/kernel/security/ima/ascii_runtime_measurements.

The next task is to create an IMA Policy configuration file in the /etc/ima directory:

$ vi /etc/ima/policy.conf

Add the following line:

audit func=BPRM_CHECK mask=MAY_EXEC

The rules you define in the policy file apply to auditing all executable files.

To load an IMA policy, enter:

$ cat /etc/ima/policy.conf > /sys/kernel/security/ima/policy

Some policies might be too general for the system. Therefore, in the future, you should adapt according to your needs.

Restart for the changes to take effect.

Auditd

Auditd is a userspace component that receives and logs information from the underlying Linux auditing system. The auditd userspace tool is a good example of an application that uses information from IMA.

The first step is to install the necessary packages. In Ubuntu:

$ sudo apt-get install auditd audispd-plugins

Or in Centos:

$ sudo yum install audit audit-libs

Once the packages are installed, you can start and enable the service with:

$ sudo systemctl start auditd
$ sudo systemctl enable auditd

All auditd events are located in:

/var/log/audit/audit.log

Each entry in the log contains a collection of values that will provide a roadmap for auditing the event. For the INTEGRITY_RULE policy, the log includes an SHA-256 hash to establish the integrity of the file, along with other settings (see Listing 2).

type=INTEGRITY_RULE msg=audit(1619631954.633.430): file="/root/script.sh"
hash="sha256:7fa8f6dae6e81358308eee2a7a77a7d71d40e8f9cadbb3e266ea39371041f8fd"
ppid=1897 pid=2007 auid=1000 uid=0 gid=0 euid=0

The auditd syntax is as follows:

-w path-to-file -p permissions (r,w,x,a) -k keyname

where -w is the path to the file or directory. -p describes the permission access type that a file system watch will trigger on (r=read, w=write, x=execute, and a=attribute). -k is the "keyname" switch, which describes what the alert is about, thus making it easier to interpret and filter the logs. The key value can be searched from SIEM or Log Management systems, so that no matter which rule triggered an event, you can find the results.

Auditd lets you create and customize rules. To make your own rules, you should add them to the file /etc/audit/rules.d/audit.rules or use the auditctl command.