linux-kernel - Re: [PATCH 2/3] binfmt_elf: Verify signature of signed elf binary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130116185741.GA3038@redhat.com>
Date:	Wed, 16 Jan 2013 13:57:41 -0500
From:	Vivek Goyal <vgoyal@...hat.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	linux-kernel@...r.kernel.org, pjones@...hat.com, hpa@...or.com,
	dhowells@...hat.com, jwboyer@...hat.com,
	Dmitry Kasatkin <dmitry.kasatkin@...el.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-security-module@...r.kernel.org
Subject: Re: [PATCH 2/3] binfmt_elf: Verify signature of signed elf binary

On Wed, Jan 16, 2013 at 01:45:12PM -0500, Mimi Zohar wrote:

[..]
> > Given the fact that signatures are stored in extended attributes, to me
> > the only way to sign executables in current IMA framework would to be
> > prepare file system image at build server and ship that image. And
> > then installer simply mounts that image (after making sure that proper
> > verification keys have been loaded in kernel).
> 
> That is one scenario.  Another scenario is to update packages to include
> extended attributes and to write those extended attributes on
> installation.

Ok, that's the point I am missing. So I can sign a file and signatures
are in a separate file. And these signatures are installed in extended
attributes at file installation time (IOW rpm installation time) on
target.

If all this works, this sounds reasonable so far. Except the point of
disabling ptrace and locking down memory. 

So what's the state of above work. Is there something I can play with.

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/