lkml.org 
[lkml]   [2013]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [RFC 0/1] ima/evm: signature verification support using asymmetric keys
Date
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> David, are you ok with how support for asymmetric keys is being added to
> EVM/IMA-appraisal for verifying signatures? Any comments?

I would also like to have a look at altering your trusted key type[*] to be a
subtype of asymmetric keys so that the asymmetric key type can cover keys from
more sources:

- Compiled-in keys.
- Keys from UEFI db.
- Keys from TPM (ie. the trusted key stuff).
- Keys loaded by the administrator _if_ they are validated by a key the
kernel already has.

[*] I believe that that's your asymmetric key type and that your encrypted key
type is your symmetric key type.

To support this, it may be necessary to make it possible to make the "trusted"
key type name a synonym of the "asymmetric" key type name in some way.

I also have some patches to divorce the module signing public keyring stuff
from module signing and make it a more generic system keyring of trusted keys
that can be used for other purposes (such as IMA and verifying additional
keys) that I shall post shortly.

On top of those patches, I have a series of patches to permit extra keys to be
added from signed PE binaries that can be found here:

http://git.kernel.org/?p=linux/kernel/git/dhowells/linux-modsign.git;a=shortlog;h=refs/heads/devel-pekey

David


\
 
 \ /
  Last update: 2013-01-17 19:41    [W:0.085 / U:0.892 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site