linux-kernel - Re: [RFC] [Patch 1/1] IBAC Patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 14 Mar 2007 11:48:42 -0700
From:	Seth Arnold <seth.arnold@...e.de>
To:	linux-kernel@...r.kernel.org
Subject: Re: [RFC] [Patch 1/1] IBAC Patch

On Wed, Mar 14, 2007 at 07:25:26AM -0400, Mimi Zohar wrote:
> It's a little bit of both. :-) Initially it was written to help me with 

:)

> implementing and testing the integrity provider.  But it could definitely stand
> on it's own.  As Serge Hallyn commented http://lkml.org/lkml/2007/3/13/220, by 
> adding the mmap hook, IBAC could replace the LSM aspect of digsig and a gpg 
> based integrity provider, could be written, instead of EVM, which is TPM based.

Thanks.

> > > +	if (status != INTEGRITY_PASS) {	/* FAIL | NO_LABEL */
> > > +		if (!is_kernel_thread(current)) {
> > 
> > Please remind me why kernel threads are exempt?
> 
> You really don't want to prevent kernel threads from working. Nasty things
> happen.

But under what conditions would a kernel thread not pass integrity? I
guess if it doesn't have an associated dentry... or the dentry refers
to something else? (What does knfsd do -- it is started by a userland
program which causes the kernel to start up some tasks for NFS..)

> For integrity_measure(), EVM calls IMA, if enabled, to extend the
> measurement list with the hash value it provides. In most cases, EVM
> has already calculated the hash value, when it was called to verify the
> data. integrity_measure() is not meant to be intrusive, so it is defined
> as void.

Oh, ok, thanks.

> Thank you for your comments.

My pleasure, thanks for the quick responses.

Content of type "application/pgp-signature" skipped