| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALLzPKYpAJ4AtiWJgDiqbJnJa-UUCChdv=bUJAwB0iV4=WVoMg@mail.gmail.com> Date: Tue, 5 Jun 2012 17:36:41 +0300 From: "Kasatkin, Dmitry" <dmitry.kasatkin@...el.com> To: David Howells <dhowells@...hat.com> Cc: Rusty Russell <rusty@...tcorp.com.au>, Mimi Zohar <zohar@...ux.vnet.ibm.com>, kyle@...artin.ca, linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org, keyrings@...ux-nfs.org, Tim Abbott <tabbott@...lice.com> Subject: Re: [PATCH 00/23] Crypto keys and module signing On Tue, Jun 5, 2012 at 4:37 PM, David Howells <dhowells@...hat.com> wrote: > Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote: > >> As the signature would be stored as an extended attribute, we wouldn't >> need to pass it. Unfortunately not all filesystems have xattr support, >> nor do all of the package installation mechanims. The benefit of >> storing the signature as an extended attribute, however, is that there >> is a consistent mechanism for verifying file data integrity for all >> files, not only ELF. > > We also want to be able to do module signature verification with CONFIG_IMA=n. Sure. In the patchset I sent some time ago, signature verification does not require CONFIG_IMA=y. modprobe reads signature from xattr or .sig file and pass it as kernel module parameter. - Dmitry > > David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists