Messages in this thread | | | Date | Wed, 16 Jan 2013 13:57:41 -0500 | From | Vivek Goyal <> | Subject | Re: [PATCH 2/3] binfmt_elf: Verify signature of signed elf binary |
| |
On Wed, Jan 16, 2013 at 01:45:12PM -0500, Mimi Zohar wrote:
[..] > > Given the fact that signatures are stored in extended attributes, to me > > the only way to sign executables in current IMA framework would to be > > prepare file system image at build server and ship that image. And > > then installer simply mounts that image (after making sure that proper > > verification keys have been loaded in kernel). > > That is one scenario. Another scenario is to update packages to include > extended attributes and to write those extended attributes on > installation.
Ok, that's the point I am missing. So I can sign a file and signatures are in a separate file. And these signatures are installed in extended attributes at file installation time (IOW rpm installation time) on target.
If all this works, this sounds reasonable so far. Except the point of disabling ptrace and locking down memory.
So what's the state of above work. Is there something I can play with.
Thanks Vivek
| |