linux-kernel - Re: [RFC PATCH v3 00/13] Clavis LSM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z92dCwEDNmESjPAs@kernel.org>
Date: Fri, 21 Mar 2025 19:08:27 +0200
From: Jarkko Sakkinen <jarkko@...nel.org>
To: James Bottomley <James.Bottomley@...senpartnership.com>
Cc: Eric Snowberg <eric.snowberg@...cle.com>,
	Paul Moore <paul@...l-moore.com>, Mimi Zohar <zohar@...ux.ibm.com>,
	David Howells <dhowells@...hat.com>,
	"open list:SECURITY SUBSYSTEM" <linux-security-module@...r.kernel.org>,
	David Woodhouse <dwmw2@...radead.org>,
	"herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
	"davem@...emloft.net" <davem@...emloft.net>,
	Ard Biesheuvel <ardb@...nel.org>, James Morris <jmorris@...ei.org>,
	"Serge E. Hallyn" <serge@...lyn.com>,
	Roberto Sassu <roberto.sassu@...wei.com>,
	Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
	Mickaël Salaün <mic@...ikod.net>,
	"casey@...aufler-ca.com" <casey@...aufler-ca.com>,
	Stefan Berger <stefanb@...ux.ibm.com>,
	"ebiggers@...nel.org" <ebiggers@...nel.org>,
	Randy Dunlap <rdunlap@...radead.org>,
	open list <linux-kernel@...r.kernel.org>,
	"keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
	"linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
	"linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
	"linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>
Subject: Re: [RFC PATCH v3 00/13] Clavis LSM

On Thu, Mar 20, 2025 at 06:40:55PM -0400, James Bottomley wrote:
> On Thu, 2025-03-20 at 16:24 +0000, Eric Snowberg wrote:
> > Having lockdown enforcement has always been 
> > a requirement to get a shim signed by Microsoft.
> 
> This is factually incorrect.  Microsoft transferred shim signing to an
> independent process run by a group of open source maintainers a while
> ago:
> 
> https://github.com/rhboot/shim-review/
> 
> If you actually look, you'll see even Microsoft has to obey this
> upstream process for their Linux distro:
> 
> https://github.com/rhboot/shim-review/issues/427

I did not know this. Thanks for educating!

> 
> Regards,
> 
> James
> 

BR, Jarkko