lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1360856159.3524.619.camel@falcor1.watson.ibm.com>
Date:	Thu, 14 Feb 2013 10:35:59 -0500
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Vivek Goyal <vgoyal@...hat.com>
Cc:	"Kasatkin, Dmitry" <dmitry.kasatkin@...el.com>,
	linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] ima: Support appraise_type=imasig_optional

On Thu, 2013-02-14 at 10:23 -0500, Vivek Goyal wrote:
> On Thu, Feb 14, 2013 at 07:57:16AM -0500, Mimi Zohar wrote:
> 
> [..]
> > > Ok, I will cleanup the code to do above. Just wanted to clear up one
> > > point. 
> > > 
> > > Above option will not have any effect on evm behavior? This only impacts
> > > IMA appraisal behavior. For example, if security.ima is not present it
> > > is fine and file access is allowed. But if EVM is enabled and initialized
> > > and EVM does not find security.evm label (INTEGRITY_NOLABEL) or returns
> > > INTEGRITY_NOXATTRS, file access should still be denied?
> > 
> > Can't happen.  evm_verifyxattr() is called from
> > ima_appraise_measurement(), only if 'security.ima' exists.
> 
> Actually what I meant is following.
> 
> Currently in process_measurement(), I will allow access if
> ima_appraise_measurement() returns INTEGRITY_NOLABEL.

I think you're making this more complicated than it needs to be.  Allow
the execution unless the file failed signature verification.  The
additional capability is given only if the signature verification
succeeds.

thanks,

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ