linux-kernel - Re: IMA: How to manage user space signing policy with others

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130228213534.GF11360@redhat.com>
Date:	Thu, 28 Feb 2013 16:35:35 -0500
From:	Vivek Goyal <vgoyal@...hat.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	linux kernel mailing list <linux-kernel@...r.kernel.org>,
	linux-security-module@...r.kernel.org
Subject: Re: IMA: How to manage user space signing policy with others

On Thu, Feb 28, 2013 at 02:23:39PM -0500, Mimi Zohar wrote:

[..]
> I would suggest that the ima_appraise_tcb, which is more restrictive, be
> permitted to replace the secureboot policy.

Also ima_appraise_tcb is not necessarily more restrictive. It takes
appraises only for root user. Files for rest of users are not appraised.

In general case of "memory locked execution of signed binary" I was
hoping to give user a flexibility to do appraisal either for root
or both root and non-root user.

For the time being I can hardcode things only for root user but the
moment somebody will extend functionality for non-root user, again
we will run into the issue that ima_appraise_tcb is not superset so
we can't allow that.

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/