linux-kernel - Re: IMA: How to manage user space signing policy with others

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1362670833.4392.438.camel@falcor1>
Date:	Thu, 07 Mar 2013 10:40:33 -0500
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Vivek Goyal <vgoyal@...hat.com>
Cc:	Eric Paris <eparis@...isplace.org>,
	linux kernel mailing list <linux-kernel@...r.kernel.org>,
	LSM List <linux-security-module@...r.kernel.org>
Subject: Re: IMA: How to manage user space signing policy with others

On Thu, 2013-03-07 at 09:36 -0500, Vivek Goyal wrote:
> On Wed, Mar 06, 2013 at 08:39:08PM -0500, Mimi Zohar wrote:
> > On Wed, 2013-03-06 at 18:55 -0500, Vivek Goyal wrote:
> > > On Wed, Mar 06, 2013 at 10:42:31AM -0500, Mimi Zohar wrote:
>  
> > Adding an IMA call to directly appraise the integrity of a file, rather
> > than adding a hook, prevents other integrity users from being able to
> > define a rule at that point.
> 
> We already have security hooks in exec() code and mmap(). And current
> integrity callers are happy with it.

Exposing integrity calls, resolves the problem of code duplication, but
does not address Rusty's third issue of improving the integrity
subsystem.  You have no idea if the existing integrity users are happy
with the status quo.  It's there and they're using it.  They could want
additional hooks or better located hooks.  Each of your complaints about
the integrity subsystem could be addressed and would improve the
subsystem.

thanks,

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/