linux-kernel - Re: Module xattr signatures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALLzPKYTaOX0SNkT_z9snyEMSQ4paKLf3H-C=O0vM-Gc8O99UA@mail.gmail.com>
Date:	Fri, 5 Oct 2012 17:42:40 +0300
From:	"Kasatkin, Dmitry" <dmitry.kasatkin@...el.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	Kasatkin@...abs.org, Kees Cook <keescook@...omium.org>,
	David Howells <dhowells@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Subject: Re: Module xattr signatures

Hello,

On Fri, Oct 5, 2012 at 4:47 AM, Rusty Russell <rusty@...tcorp.com.au> wrote:
>
> Hi all,
>
>         Had a talk with Mimi, and IMA still wants xattr signatures on
> modules like they have for other files with EVM.  With Kees' patches now
> merged into my modules-wip branch (warning, rebases frequently), this
> should be pretty simple.  Dmitry?
>

Yes, there is no difference for IMA/EVM what type of file has a
signature to verify.
It just reads the signature from the xattr. With the module hook it
will just do the same
for modules as well. It is independent of appended signature verification.
The format of signatures is different at the moment.

>         The question of whether this falls back to appended signatures
> if there's no xattr support, or whether we fix cpio depends on whether
> someone is prepared to do the latter.  As Mimi points out, AIX, bsd,
> solaris all have versions of cpio that support extended attributes, as
> does the bsdcpio Debian package, for example.
>

As I already said in one of my early mails, I am not sure at all if
IMA really needs to verify a signature,
if primary mechanism is to use appended signature.

- Dmitry

> Thanks,
> Rusty.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/