linux-kernel - Re: [RFC PATCH v3 00/13] Clavis LSM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <95e7a43a2dd675615a146c56a10abf6921f955f9.camel@HansenPartnership.com>
Date: Thu, 20 Mar 2025 18:40:55 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Eric Snowberg <eric.snowberg@...cle.com>, Paul Moore
 <paul@...l-moore.com>
Cc: Mimi Zohar <zohar@...ux.ibm.com>, David Howells <dhowells@...hat.com>, 
 Jarkko Sakkinen <jarkko@...nel.org>, "open list:SECURITY SUBSYSTEM"
 <linux-security-module@...r.kernel.org>,  David Woodhouse
 <dwmw2@...radead.org>, "herbert@...dor.apana.org.au"
 <herbert@...dor.apana.org.au>,  "davem@...emloft.net"
 <davem@...emloft.net>, Ard Biesheuvel <ardb@...nel.org>, James Morris
 <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>, Roberto Sassu
 <roberto.sassu@...wei.com>, Dmitry Kasatkin <dmitry.kasatkin@...il.com>, 
 Mickaël Salaün <mic@...ikod.net>,
 "casey@...aufler-ca.com" <casey@...aufler-ca.com>, Stefan Berger
 <stefanb@...ux.ibm.com>, "ebiggers@...nel.org" <ebiggers@...nel.org>, Randy
 Dunlap <rdunlap@...radead.org>, open list <linux-kernel@...r.kernel.org>, 
 "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
 "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
 "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
 "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>
Subject: Re: [RFC PATCH v3 00/13] Clavis LSM

On Thu, 2025-03-20 at 16:24 +0000, Eric Snowberg wrote:
> Having lockdown enforcement has always been 
> a requirement to get a shim signed by Microsoft.

This is factually incorrect.  Microsoft transferred shim signing to an
independent process run by a group of open source maintainers a while
ago:

https://github.com/rhboot/shim-review/

If you actually look, you'll see even Microsoft has to obey this
upstream process for their Linux distro:

https://github.com/rhboot/shim-review/issues/427

Regards,

James