linux-kernel - Re: [PATCH 3/6] firmware: differentiate between signed regulatory.db and other firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 15 May 2018 08:43:39 -0400
From:   Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:     Josh Boyer <jwboyer@...nel.org>, mcgrof@...nel.org
Cc:     Harald Hoyer <harald@...hat.com>, Hannes Reinecke <hare@...e.de>,
        Johannes Thumshirn <jthumshirn@...e.de>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Casey Schaufler <casey@...aufler-ca.com>, ast@...nel.org,
        David Miller <davem@...emloft.net>, jeyu@...nel.org,
        Alexander Viro <viro@...iv.linux.org.uk>,
        One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
        Matthew Garrett <mjg59@...f.ucam.org>,
        Peter Jones <pjones@...hat.com>, takahiro.akashi@...aro.org,
        David Howells <dhowells@...hat.com>,
        Linux Wireless <linux-wireless@...r.kernel.org>,
        Kalle Valo <kvalo@...eaurora.org>,
        Seth Forshee <seth.forshee@...onical.com>,
        johannes.berg@...el.com, linux-integrity@...r.kernel.org,
        Hans de Goede <hdegoede@...hat.com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        linux-security-module <linux-security-module@...r.kernel.org>,
        "Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
        Kees Cook <keescook@...omium.org>,
        Greg KH <gregkh@...uxfoundation.org>, andresx7@...il.com,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        luto@...nel.org, Justin Forbes <jforbes@...hat.com>,
        Laura Abbott <labbott@...hat.com>
Subject: Re: [PATCH 3/6] firmware: differentiate between signed
 regulatory.db and other firmware

On Tue, 2018-05-15 at 08:32 -0400, Josh Boyer wrote:

> One aspect that was always a concern to some is whether the firmware files
> were modified directly to have the signature attached to them.  That may
> run afoul of the "no modification" license that most blobs are shipped
> under.  Does IMA have the signatures for the files stored in xattrs or in
> some other detached manner?

They're stored as xattrs.  RPM has support for including file
signatures in the RPM header.

Mimi