Messages in this thread | | | Subject | Re: Linux Firmware Signing | From | Mimi Zohar <> | Date | Tue, 01 Sep 2015 23:35:05 -0400 |
| |
On Wed, 2015-09-02 at 02:09 +0200, Luis R. Rodriguez wrote: > On Tue, Sep 01, 2015 at 01:20:37PM -0700, Kees Cook wrote: > > On Thu, Aug 27, 2015 at 2:29 PM, Luis R. Rodriguez <mcgrof@suse.com> wrote: > > As long as the LSM know what kind of file it's loading, and has access > > to the fd (and for IMA, the blob loaded from that fd), that should be > > everything it needs. IMA has the name and blob, loadpin has the fd, > > and a future signature-checking LSM could be able to look up signature > > type from the load type, and split the key off (or fetch the key file) > > itself.
I assume "and for IMA, the blob loaded from that fd" is referring to the file signature stored in the xattr.
> OK great, I think that instead of passing the actual routine name we should > instead pass an enum type for to the LSM, that'd be easier to parse and we'd > then have each case well documented. Each LSM then could add its own > documetnation for this and can switch on it. If we went with a name we'd have > to to use something like __func__ and then parse that, its not clear if we need > to get that specific.
Agreed. IMA already defines an enumeration.
/* IMA policy related functions */ enum ima_hooks { FILE_CHECK = 1, MMAP_CHECK, BPRM_CHECK, MODULE_CHECK, FIRMWARE_CHECK, POLICY_CHECK, POST_SETATTR };
Mimi
| |