linux-kernel - Re: [PATCH -next RFC 0/4] IMA Root of Trust (RoT) Framework

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6692fd251851b80b5d94d3804508473451185e78.camel@HansenPartnership.com>
Date: Mon, 30 Jun 2025 10:13:15 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: GONG Ruiqi <gongruiqi1@...wei.com>, Mimi Zohar <zohar@...ux.ibm.com>, 
 Roberto Sassu <roberto.sassu@...wei.com>, Dmitry Kasatkin
 <dmitry.kasatkin@...il.com>
Cc: Eric Snowberg <eric.snowberg@...cle.com>, Paul Moore
 <paul@...l-moore.com>,  James Morris <jmorris@...ei.org>, "Serge E .
 Hallyn" <serge@...lyn.com>, linux-kernel@...r.kernel.org, 
 linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org, Lu
 Jialin <lujialin4@...wei.com>, linux-coco@...ts.linux.dev
Subject: Re: [PATCH -next RFC 0/4] IMA Root of Trust (RoT) Framework

[+cc linux-coco]
On Mon, 2025-06-30 at 20:59 +0800, GONG Ruiqi wrote:
[...]
> This patch set provides an implementation of the aforementioned IMA
> RoT framework, which can facilitate easier adaptation for new devices
> such as Intel TDX and Huawei VirtCCA, as well as the classic TPM, to
> be an RoT that IMA can utilize to maintain system's integrity.

This is inventing a separate but parallel system to the Coco TSM one. 
If IMA is going to measure to TDX RTMRs, there should at least be some
integration.  In theory the TSM backend can also do TPMs, so it looks
like it should become what you're calling the ROT for IMA subsystem and
IMA should simply make use of it.

Regards,

James