Puppet Class: tpm::ima::policy

Defined in:
manifests/ima/policy.pp

Overview

Manage IMA Policy

* The term 'watch', as used here, means both IMA policy fields dont_measure
  and dont_appraise. Both lines will be dropped for each entry here.

Parameters:

  • manage (Boolean) (defaults to: false) —

    Enable policy management

  • dont_watch_proc (Boolean) (defaults to: true) —

    If true, disable IMA hashing of procfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_sysfs (Boolean) (defaults to: true) —

    If true, disable IMA hashing of sysfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_debugfs (Boolean) (defaults to: true) —

    If true, disable IMA hashing of debugfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_tmpfs (Boolean) (defaults to: true) —

    If true, disable IMA hashing of tmpfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_ramfs (Boolean) (defaults to: true) —

    If true, disable IMA hashing of ramfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_securityfs (Boolean) (defaults to: true) —

    If true, disable IMA hashing of securityfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_devpts (Boolean) (defaults to: true) —

    If true, disable IMA hashing of /dev/pts filesystems, as noted by the kernel magic documentation above.

  • dont_watch_binfmtfs (Boolean) (defaults to: true) —

    If true, disable IMA hashing of binfmtfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_selinux (Boolean) (defaults to: true) —

    If true, disable IMA hashing of selinux fs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_nfs (Boolean) (defaults to: true) —

    If true, disable IMA hashing of nfs filesystems, as noted by the kernel magic documentation above.

  • dont_watch_cgroup (Boolean) (defaults to: true) —

    If true, disable IMA hashing of cgroup filesystems, as noted by the kernel magic documentation above.

  • dont_watch_initrc_var_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context initrc_var_log_t

  • dont_watch_rpm_var_cache_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context rpm_var_cache_t

  • dont_watch_puppet_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context puppet_log_t

  • dont_watch_auditd_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context auditd_log_t

  • dont_watch_auth_cache_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context auth_cache_t

  • dont_watch_fsadm_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context fsadm_log_t

  • dont_watch_rsync_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context rsync_log_t

  • dont_watch_getty_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context getty_log_t

  • dont_watch_nscd_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context nscd_log_t

  • dont_watch_cron_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context cron_log_t

  • dont_watch_lastlog_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context lastlog_t

  • dont_watch_var_log_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context var_log_t

  • dont_watch_wtmp_t (Boolean) (defaults to: true) —

    If true, don’t watch selinux context wtmp_t

  • dont_watch_list (Array[String]) (defaults to: []) —

    A list of selinux contexts that shouldn’t be watched, merged with all of the parameters above

  • measure_root_read_files (Boolean) (defaults to: true) —

    Monitor all files opened by root

  • measure_file_mmap (Boolean) (defaults to: true) —

    Monitor all files mmapped executable in file_mmap

  • measure_bprm_check (Boolean) (defaults to: true) —

    Monitor all executables in bprm_check

  • measure_module_check (Boolean) (defaults to: true)
  • appraise_fowner (Boolean) (defaults to: true) —

    Appraises all files owned by root

See Also:

Author:

  • Nick Miller <nick.miller@onyxpoint.com>



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
 
# File 'manifests/ima/policy.pp', line 73

class tpm::ima::policy (
  Boolean $manage = false,

  # magic filesystems, default settings
  Boolean $dont_watch_proc       = true,
  Boolean $dont_watch_sysfs      = true,
  Boolean $dont_watch_debugfs    = true,
  Boolean $dont_watch_tmpfs      = true,
  Boolean $dont_watch_ramfs      = true,
  Boolean $dont_watch_securityfs = true,
  # magic, additional settings
  Boolean $dont_watch_devpts     = true,
  Boolean $dont_watch_binfmtfs   = true,
  Boolean $dont_watch_selinux    = true,
  Boolean $dont_watch_nfs        = true,
  Boolean $dont_watch_cgroup     = true,

  # selinux contexts
  Boolean $dont_watch_initrc_var_log_t = true,
  Boolean $dont_watch_rpm_var_cache_t  = true,
  Boolean $dont_watch_puppet_log_t     = true,
  Boolean $dont_watch_auditd_log_t     = true,
  Boolean $dont_watch_auth_cache_t     = true,
  Boolean $dont_watch_fsadm_log_t      = true,
  Boolean $dont_watch_rsync_log_t      = true,
  Boolean $dont_watch_getty_log_t      = true,
  Boolean $dont_watch_nscd_log_t       = true,
  Boolean $dont_watch_cron_log_t       = true,
  Boolean $dont_watch_lastlog_t        = true,
  Boolean $dont_watch_var_log_t        = true,
  Boolean $dont_watch_wtmp_t           = true,
  Array[String] $dont_watch_list = [],

  # other defaults
  Boolean $measure_root_read_files = true,
  Boolean $measure_file_mmap       = true,
  Boolean $measure_bprm_check      = true,
  Boolean $measure_module_check    = true,
  Boolean $appraise_fowner         = true,
){

  # magic reference is in Kernel documentation Documentation/ABI/testing/ima_policy
  $magic_hash = {
    '0x9fa0'     => $dont_watch_proc,
    '0x62656572' => $dont_watch_sysfs,
    '0x64626720' => $dont_watch_debugfs,
    '0x01021994' => $dont_watch_tmpfs,
    '0x858458f6' => $dont_watch_ramfs,
    '0x73636673' => $dont_watch_securityfs,
    '0x1cd1'     => $dont_watch_devpts,
    '0x42494e4d' => $dont_watch_binfmtfs,
    '0xf97cff8c' => $dont_watch_selinux,
    '0x6969'     => $dont_watch_nfs,
    '0x27e0eb'   => $dont_watch_cgroup,
  }

  $sel_hash = {
    initrc_var_log_t => $dont_watch_initrc_var_log_t,
    rpm_var_cache_t  => $dont_watch_rpm_var_cache_t,
    puppet_log_t     => $dont_watch_puppet_log_t,
    auditd_log_t     => $dont_watch_auditd_log_t,
    auth_cache_t     => $dont_watch_auth_cache_t,
    fsadm_log_t      => $dont_watch_fsadm_log_t,
    rsync_log_t      => $dont_watch_rsync_log_t,
    getty_log_t      => $dont_watch_getty_log_t,
    nscd_log_t       => $dont_watch_nscd_log_t,
    cron_log_t       => $dont_watch_cron_log_t,
    lastlog_t        => $dont_watch_lastlog_t,
    var_log_t        => $dont_watch_var_log_t,
    wtmp_t           => $dont_watch_wtmp_t,
  }

  if $manage {
    file { '/etc/ima':
      ensure => directory,
      mode   => '0750',
    }

    file { '/etc/ima/policy.conf':
      ensure  => file,
      mode    => '0640',
      content => template('tpm/ima_policy.conf.erb'),
      require => File['/etc/ima'],
      notify  => Exec['load_ima_policy']
    }

    exec { 'load_ima_policy':
      command => 'cat /etc/ima/policy.conf > /sys/kernel/security/ima/policy',
      unless  => 'grep ima_reboot `puppet config print vardir`/reboot_notifications.json',
      path    => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin',
      require => File['/etc/ima/policy.conf'],
    }

    if member($facts['init_systems'], 'systemd') {
      file { '/usr/lib/systemd/system/import_ima_rules.service':
        ensure => file,
        mode   => '0644',
        source => 'puppet:///modules/tpm/import_ima_rules.service'
      }
      service { 'import_ima_rules.service':
        ensure  => running,
        enable  => true,
        require => File['/usr/lib/systemd/system/import_ima_rules.service']
      }
    }
    else {
      file { '/etc/init.d/import_ima_rules':
        ensure => file,
        mode   => '0755',
        source => 'puppet:///modules/tpm/import_ima_rules'
      }
      service { 'import_ima_rules':
        ensure  => stopped,
        enable  => true,
        require => File['/etc/init.d/import_ima_rules']
      }
    }
  }
  else {
    if member($facts['init_systems'], 'systemd') {
      file { '/usr/lib/systemd/system/import_ima_rules.service':
        ensure => absent,
      }
      service { 'import_ima_rules.service':
        ensure => stopped,
        enable => false,
      }
    }
    else {
      file { '/etc/init.d/import_ima_rules':
        ensure => absent,
      }
      service { 'import_ima_rules':
        ensure => stopped,
        enable => false,
      }
    }
  }

}