Messages in this thread | | | Subject | Re: [RFC PATCH 0/6][v3] ima: Support a mode to appraise signed files only | From | Mimi Zohar <> | Date | Thu, 14 Feb 2013 15:51:24 -0500 |
| |
On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote: > Hi, > > Currently ima appraises all the files as specified by the rule.
Currently IMA appraises files based on policy.
> So > if one wants to create a system where only few executables are > signed, that system will not work with IMA.
This statement misrepresents the IMA policy. You can definitely define a policy that only measures/appraises a few specific files. In your usecase scenario, you are not willing to rely on LSM labels. Policy rules can also be based on file owner. We could also add support for gid.
> With secureboot, one needs to disable kexec so that unsigned kernels > can't be booted. To avoid this problem, it was proposed that sign > /sbin/kexec binary and if signatures are verified successfully, give > an special capability to the /sbin/kexec process. And in secureboot > mode processes with that special capability can invoke sys_kexec() > system call.
Please add here that you then rely on /sbin/kexec to verify the integrity of the kernel image.
thanks,
Mimi
| |