๐Ÿ›ก๏ธ EVM (Extended Verification Module) Simulator Metadata HMAC Protection

ํ™•์žฅ ์†์„ฑ(xattr) ๋ฐ inode ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ์œ„๋ณ€์กฐ ๋ฐฉ์ง€, HMAC-SHA256 ๊ฒ€์ฆ ๋ฐ ๊ถŒํ•œ ์ƒ์Šน ์ฐจ๋‹จ

Enforce (Hardened)
โšก EVM ๋ณตํ•ฉ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ํ•ด์‹œ ๊ฒ€์ฆ ํŒŒ์ดํ”„๋ผ์ธ ์‹ค์‹œ๊ฐ„ HMAC-SHA256 ๊ณ„์‚ฐ ๋ฐ ๊ฑฐ๋ถ€ ํŒ์ • ์ถ”์ 
File Inode & XATTRs xattrs: security.ima, selinux inode: uid=1000 gid=1000 mode=0755 ino=2048 EVM Engine HMAC-SHA256(Key, Meta) hmac: a1b2c3d4... Key: Encrypted Keyring 'security.evm' Signature Stored Golden HMAC ref: a1b2c3d4... Filesystem XATTR Record evm_verify_current_integrity() Compare computed vs stored HMAC LSM Hook: inode_permission() โœ… Metadata VALID HMAC Matches 'security.evm' Operation permitted (ret = 0) ๐Ÿ›‘ BLOCKED (-EPERM) Metadata / XATTR Tampered audit(evm): invalid-HMAC

๐Ÿ“Š EVM ๋Ÿฐํƒ€์ž„ ์ง€ํ‘œ

EVM ๊ฒ€์ฆ ๋ชจ๋“œ: Enforce
์ธ์ฆ ์•Œ๊ณ ๋ฆฌ์ฆ˜: HMAC-SHA256
๋ณดํ˜ธ ๋Œ€์ƒ XATTR: ima, selinux, cap
์ด ๊ฒ€์ฆ ํšŸ์ˆ˜: 0 ํšŒ
๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ์œ„๋ฐ˜ ์ฐจ๋‹จ: 0 ๊ฑด

๐Ÿ”’ ์™œ IMA์™€ EVM์ด ํ•จ๊ป˜ ํ•„์š”ํ•œ๊ฐ€?

IMA๋Š” ํŒŒ์ผ ๋‚ด์šฉ(Content)๋งŒ ๊ฒ€์‚ฌํ•˜๋ฏ€๋กœ, ๊ณต๊ฒฉ์ž๊ฐ€ ํŒŒ์ผ ๋ณธ๋ฌธ์„ ๊ฑด๋“œ๋ฆฌ์ง€ ์•Š๊ณ  security.capability๋ฅผ ์กฐ์ž‘(์˜ˆ: ์ผ๋ฐ˜ ๋ฐ”์ด๋„ˆ๋ฆฌ์— CAP_SETUID ๋ถ€์—ฌ)ํ•˜๊ฑฐ๋‚˜ ์†Œ์œ ์ž(UID 0)๋ฅผ ๋ฐ”๊พธ๋ฉด ๋ฃจํŠธ ๊ถŒํ•œ์„ ํƒˆ์ทจ๋‹นํ•  ์ˆ˜ ์žˆ์Œ. EVM์€ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ์ „์ฒด๋ฅผ HMAC/์ „์ž์„œ๋ช…์œผ๋กœ ๋ฌถ์–ด ์˜คํ”„๋ผ์ธ ๋ณ€์กฐ๋ฅผ ์›์ฒœ ์ฐจ๋‹จํ•จ.

๐Ÿ“‹ EVM ๊ฐ์‚ฌ ๋ฐ ๋ฌด๊ฒฐ์„ฑ ์ด๋ฒคํŠธ
[init] EVM subsystem active. Key: encrypted master keyring
[policy] Protected xattrs: security.ima, security.selinux, security.capability