lkml.org 
[lkml]   [2013]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC PATCH 0/6][v3] ima: Support a mode to appraise signed files only
From
Date
On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote:
> Hi,
>
> Currently ima appraises all the files as specified by the rule.

Currently IMA appraises files based on policy.

> So
> if one wants to create a system where only few executables are
> signed, that system will not work with IMA.

This statement misrepresents the IMA policy. You can definitely define
a policy that only measures/appraises a few specific files. In your
usecase scenario, you are not willing to rely on LSM labels. Policy
rules can also be based on file owner. We could also add support for
gid.

> With secureboot, one needs to disable kexec so that unsigned kernels
> can't be booted. To avoid this problem, it was proposed that sign
> /sbin/kexec binary and if signatures are verified successfully, give
> an special capability to the /sbin/kexec process. And in secureboot
> mode processes with that special capability can invoke sys_kexec()
> system call.

Please add here that you then rely on /sbin/kexec to verify the
integrity of the kernel image.

thanks,

Mimi



\
 
 \ /
  Last update: 2013-02-14 22:23    [W:0.093 / U:0.284 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site