Messages in this thread | | | From | Thiago Jung Bauermann <> | Subject | Re: [PATCH v12 00/11] Appended signatures support for IMA appraisal | Date | Mon, 26 Aug 2019 22:04:43 -0300 |
| |
Hello Jordan,
Jordan Hand <jorhand@linux.microsoft.com> writes:
> On 6/27/19 7:19 PM, Thiago Jung Bauermann wrote: >> On the OpenPOWER platform, secure boot and trusted boot are being >> implemented using IMA for taking measurements and verifying signatures. >> Since the kernel image on Power servers is an ELF binary, kernels are >> signed using the scripts/sign-file tool and thus use the same signature >> format as signed kernel modules. >> >> This patch series adds support in IMA for verifying those signatures. >> It adds flexibility to OpenPOWER secure boot, because it allows it to boot >> kernels with the signature appended to them as well as kernels where the >> signature is stored in the IMA extended attribute. > > I know this is pretty late, but I just wanted to let you know that I > tested this patch set on x86_64 with QEMU. > > That is, I enrolled a key to _ima keyring, signed my kernel and modules > with appended signatures (with scripts/sign-file), set the IMA policy to > appraise and measure my kernel and modules. Also tested kexec appraisal. > > You can add my tested-by if you'd like.
Thanks for testing!
-- Thiago Jung Bauermann IBM Linux Technology Center
| |