linux-kernel - Re: [PATCH 00/12] One more attempt at useful kernel lockdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1378857327.2257.214.camel@dhcp-9-2-203-236.watson.ibm.com>
Date:	Tue, 10 Sep 2013 19:55:27 -0400
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	David Lang <david@...g.hm>, Kees Cook <keescook@...omium.org>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
	Matthew Garrett <matthew.garrett@...ula.com>,
	Henrique de Moraes Holschuh <hmh@....eng.br>,
	"Valdis.Kletnieks@...edu" <Valdis.Kletnieks@...edu>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
	"jmorris@...ei.org" <jmorris@...ei.org>,
	"linux-security-module@...r.kernel.org" 
	<linux-security-module@...r.kernel.org>,
	Elena Reshetova <elena.reshetova@...el.com>
Subject: Re: [PATCH 00/12] One more attempt at useful kernel lockdown

On Tue, 2013-09-10 at 16:48 -0700, H. Peter Anvin wrote:
> On 09/10/2013 04:43 PM, Mimi Zohar wrote:
> > 
> > Why invent yet another method of verifying the integrity of a file based
> > on a signature?  Why not use the existing method for appraising files?
> > Just create a new integrity hook at the appropriate place.
> > 
> 
> What would the deliverables be from the hardware vendor and what tools
> would you expect them to need on their end?

The package installer needs to not only install files, but file metadata
as well.  Elena Reshetova (Intel) has already added rpm hooks to write
security xattrs.  The next step, yet to be done, is to include and write
the signatures as part of the rpm install process.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/