lkml.org 
[lkml]   [2019]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PULL REQUEST] Kernel lockdown patches for 5.2
    From
    Date
    On Wed, 2019-03-06 at 15:58 -0800, Matthew Garrett wrote:

    > 3) The integration with IMA has been dropped for now. IMA is in the
    > process of adding support for architecture-specific policies that will
    > interact correctly with the lockdown feature, and a followup patch will
    > integrate that so we don't end up with an ordering dependency on the
    > merge

    The architecture specific policy is an attempt to coordinate between
    the different signature verification methods (eg. PE and IMA kexec
    kernel image signatures, appended and IMA kernel module signatures).
     The coordination between these signature verification methods is
    independent of the "lockdown" feature.

    To prevent requiring multiple signature verifications, an IMA policy
    rule(s) is defined only if either KEXEC_VERIFY_SIG or MODULE_SIG is
    not enabled.

    The kexec and kernel modules patches in this patch set continues to
    ignore IMA.  This patch set should up front either provide an
    alternative solution to coordinate the different signature
    verification methods or rely on the architecture specific policy for
    that coordination.

    Mimi

    \
     
     \ /
      Last update: 2019-03-07 04:57    [W:3.370 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site