Procedure

1. To create a trusted key using a TPM, execute:

   # keyctl add trusted <name> "new <key_length> [options]" <key_ring>

   • Based on the syntax, construct an example command as follows:

     # keyctl add trusted kmk "new 32" @u
     642500861

     The command creates a trusted key called kmk with the length of 32 bytes (256 bits) and places it in the user keyring (@u). The keys may have a length of 32 to 128 bytes (256 to 1024 bits).

2. To list the current structure of the kernel keyrings:

   # keyctl show
   Session Keyring
          -3 --alswrv    500   500  keyring: _ses
    97833714 --alswrv    500    -1   \_ keyring: _uid.1000
   642500861 --alswrv    500   500       \_ trusted: kmk

3. To export the key to a user-space blob, execute:

   # keyctl pipe 642500861 > kmk.blob

   The command uses the pipe subcommand and the serial number of kmk.

4. To load the trusted key from the user-space blob, use the add subcommand with the blob as an argument:

   # keyctl add trusted kmk "load `cat kmk.blob`" @u
   268728824

5. Create secure encrypted keys based on the TPM-sealed trusted key:

   # keyctl add encrypted <pass:quotes[name]> "new [format] <pass:quotes[key_type]>:<pass:quotes[primary_key_name]> <pass:quotes[keylength]>" <pass:quotes[key_ring]>

   • Based on the syntax, generate an encrypted key using the already created trusted key:

     # keyctl add encrypted encr-key "new trusted:kmk 32" @u
     159771175

     The command uses the TPM-sealed trusted key (kmk), produced in the previous step, as a primary key for generating encrypted keys.

Procedure

1. Use a random sequence of numbers to generate a user key:

   # keyctl add user kmk-user "$(dd if=/dev/urandom bs=1 count=32 2>/dev/null)" @u
   427069434

   The command generates a user key called kmk-user which acts as a primary key and is used to seal the actual encrypted keys.

2. Generate an encrypted key using the primary key from the previous step:

   # keyctl add encrypted encr-key "new user:kmk-user 32" @u
   1012412758

3. Optionally, list all keys in the specified user keyring:

   # keyctl list @u
   2 keys in keyring:
   427069434: --alswrv  1000  1000 user: kmk-user
   1012412758: --alswrv  1000  1000 encrypted: encr-key

Procedure

1. Add the following kernel command line parameters:

   # grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="ima_policy=appraise_tcb ima_appraise=fix evm=fix"

   The command enables IMA and EVM in the fix mode for the current boot entry and allows users to gather and update the IMA measurements.

   The ima_policy=appraise_tcb kernel command line parameter ensures that the kernel uses the default Trusted Computing Base (TCB) measurement policy and the appraisal step. The appraisal part forbids access to files, whose prior and current measures do not match.

2. Reboot to make the changes come into effect.

3. Optionally, verify that the parameters have been added to the kernel command line:

   # cat /proc/cmdline
   BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-167.el8.x86_64 root=/dev/mapper/rhel-root ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet ima_policy=appraise_tcb ima_appraise=fix evm=fix

4. Create a kernel master key to protect the EVM key:

   # keyctl add user kmk "$(dd if=/dev/urandom bs=1 count=32 2> /dev/null)" @u
   748544121

   The kernel master key (kmk) is kept entirely in the kernel space memory. The 32-byte long value of the kernel master key kmk is generated from random bytes from the /dev/urandom file and placed in the user (@u) keyring. The key serial number is on the second line of the previous output.

5. Create an encrypted EVM key based on the kmk key:

   # keyctl add encrypted evm-key "new user:kmk 64" @u
   641780271

   The command uses kmk to generate and encrypt a 64-byte long user key (named evm-key) and places it in the user (@u) keyring. The key serial number is on the second line of the previous output.

   Important

   It is necessary to name the user key as evm-key because that is the name the EVM subsystem is expecting and is working with.

6. Create a directory for exported keys:

   # mkdir -p /etc/keys/

7. Search for the kmk key and export its value into a file:

   # keyctl pipe keyctl search @u user kmk > /etc/keys/kmk*

   The command places the unencrypted value of the kernel master key (kmk) into a file of previously defined location (/etc/keys/).

8. Search for the evm-key user key and export its value into a file:

   # keyctl pipe keyctl search @u encrypted evm-key > /etc/keys/evm-key

   The command places the encrypted value of the user evm-key key into a file of arbitrary location. The evm-key has been encrypted by the kernel master key earlier.

9. Optionally, view the newly created keys:

   # keyctl show
   Session Keyring
   974575405   --alswrv     0        0      keyring: _ses
   299489774   --alswrv     0    65534       \_ keyring: _uid.0
   748544121   --alswrv     0        0           \_ user: kmk
   641780271   --alswrv     0        0           \_ encrypted: evm-key

   You should be able to see a similar output.

10. Activate EVM:

    # echo 1 > /sys/kernel/security/evm

11. Optionally, verify that EVM has been initialized:

    # dmesg | tail -1
    […​] evm: key initialized

Procedure

1. Create a test file:

   # echo <Test_text> > test_file

   IMA and EVM ensure that the example file test_file is assigned hash values, which are stored as its extended attributes.

2. Inspect extended attributes of the file:

   # getfattr -m . -d test_file
   # file: test_file
   security.evm=0sAnDIy4VPA0HArpPO/EqiutnNyBql
   security.ima=0sAQOEDeuUnWzwwKYk+n66h/vby3eD
   security.selinux="unconfined_u:object_r:admin_home_t:s0"

   The previous example output shows extended attributes related to SELinux and the IMA and EVM hash values. EVM actively adds a security.evm extended attribute and detects any offline tampering to xattrs of other files such as security.ima that are directly related to content integrity of files. The value of the security.evm field is in Hash-based Message Authentication Code (HMAC-SHA1), which was generated with the evm-key user key.