lkml.org 
[lkml]   [2013]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 2/3] KEYS: Separate the kernel signature checking keyring from module signing
Date
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> Lets assume accepting built in keys should is acceptable for all use
> cases. Adding additional keys from userspace is probably not acceptable
> for all use cases. Those keys should be added to specific 'trusted'
> keyrings.
>
> EVM and IMA-appraisal have separate keyrings for this reason. I might
> be interested in allowing third party packages to be installed and
> executed, but that doesn't imply that a security.evm extended attribute,
> signed by a third party application, is acceptable.

We should probably look at using the capability of X.509 certificates to
indicate what a key may be used for and noting that in the public_key struct.

David


\
 
 \ /
  Last update: 2013-01-18 00:02    [W:0.107 / U:2.600 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site