linux-kernel - Re: [RFC PATCH 0/6][v3] ima: Support a mode to appraise signed files only

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1360875084.3524.695.camel@falcor1.watson.ibm.com>
Date:	Thu, 14 Feb 2013 15:51:24 -0500
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Vivek Goyal <vgoyal@...hat.com>
Cc:	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, dmitry.kasatkin@...el.com
Subject: Re: [RFC PATCH 0/6][v3] ima: Support a mode to appraise signed
 files only

On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote:
> Hi,
> 
> Currently ima appraises all the files as specified by the rule.

Currently IMA appraises files based on policy.

>  So
> if one wants to create a system where only few executables are
> signed, that system will not work with IMA.

This statement misrepresents the IMA policy.  You can definitely define
a policy that only measures/appraises a few specific files.  In your
usecase scenario, you are not willing to rely on LSM labels.  Policy
rules can also be based on file owner.  We could also add support for
gid.

> With secureboot, one needs to disable kexec so that unsigned kernels
> can't be booted. To avoid this problem, it was proposed that sign
> /sbin/kexec binary and if signatures are verified successfully, give
> an special capability to the /sbin/kexec process. And in secureboot
> mode processes with that special capability can invoke sys_kexec()
> system call.

Please add here that you then rely on /sbin/kexec to verify the
integrity of the kernel image.

thanks,

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/