| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20130128185625.GC5868@redhat.com> Date: Mon, 28 Jan 2013 13:56:25 -0500 From: Vivek Goyal <vgoyal@...hat.com> To: "Kasatkin, Dmitry" <dmitry.kasatkin@...el.com> Cc: Mimi Zohar <zohar@...ux.vnet.ibm.com>, dhowells@...hat.com, jmorris@...ei.org, linux-security-module@...r.kernel.org, linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [RFC 1/1] ima: digital signature verification using asymmetric keys On Mon, Jan 28, 2013 at 05:20:20PM +0200, Kasatkin, Dmitry wrote: [..] > > Ok. I am hoping that it will be more than the kernel command line we > > support. In the sense that for digital signatures one needs to parse > > the signature, look at what hash algorithm has been used and then > > collect the hash accordingly. It is little different then IMA requirement > > of calculating one pre-determine hash for all files. > > Yes... It is obvious. It's coming. > But in general, signer should be aware of requirements and limitation > of the platform. > It is not really a problem... One more question. I specified "ima_appraise_tcb" on kernel command line and I had an unbootable system. It refused to run "init" as it was not labeled/signed. Is there any policy/way where it appraises only signed files and does not refuse to open/execute unsigned ones. Thanks Vivek -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists