Messages in this thread | | | Date | Tue, 29 Jan 2013 13:20:12 -0500 | From | Vivek Goyal <> | Subject | Re: [RFC 1/1] ima: digital signature verification using asymmetric keys |
| |
On Mon, Jan 28, 2013 at 08:48:55PM -0500, Mimi Zohar wrote:
[..] > > Hi Mimi, > > > > By policy you mean ima rules here? So I can either enable default rules > > (tcb default rules for appraisal and measurement) by using kernel command > > line options or dynamically configure my own rules using /sysfs interface? > > > > If yes, AFAIK, existing inputtable policies do not allow this selective > > mode where we do appraisal only on signed executable. That means I shall > > have to extend the way policies can be specified so that one specify > > that appraise only signed files? > > We've just added the ability of defining the method for appraising a > file and defining rules in terms of the filesystem UUID. Extending the > IMA policy shouldn't be a problem, but I'm not sure how you would go > about adding support for only appraising files with digital signatures.
Hi Mimi,
Can we add another field to ima_rule_entry, say .enforcement to control the behavior of .action. Possible values of .enforcement could be, say.
ALL SIGNED_ONLY
ALL will be default. And with .action= MEASURE, one could possibly use .enforcement=SIGNED_ONLY.
Thanks Vivek
| |