lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 27 Feb 2022 12:46:48 -0500 From: Mimi Zohar <zohar@...ux.ibm.com> To: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Cc: Roberto Sassu <roberto.sassu@...wei.com>, "shuah@...nel.org" <shuah@...nel.org>, "ast@...nel.org" <ast@...nel.org>, "daniel@...earbox.net" <daniel@...earbox.net>, "andrii@...nel.org" <andrii@...nel.org>, "kpsingh@...nel.org" <kpsingh@...nel.org>, "revest@...omium.org" <revest@...omium.org>, "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>, "linux-security-module@...r.kernel.org" <linux-security-module@...r.kernel.org>, "linux-kselftest@...r.kernel.org" <linux-kselftest@...r.kernel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "bpf@...r.kernel.org" <bpf@...r.kernel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org> Subject: Re: [PATCH v2 0/6] bpf-lsm: Extend interoperability with IMA On Sat, 2022-02-26 at 09:07 +0100, Greg Kroah-Hartman wrote: > On Fri, Feb 25, 2022 at 02:11:04PM -0500, Mimi Zohar wrote: > > On Fri, 2022-02-25 at 08:41 +0000, Roberto Sassu wrote: > > > > From: Mimi Zohar [mailto:zohar@...ux.ibm.com] > > > > Sent: Friday, February 25, 2022 1:22 AM > > > > Hi Roberto, > > > > > > > > On Tue, 2022-02-15 at 13:40 +0100, Roberto Sassu wrote: > > > > > Extend the interoperability with IMA, to give wider flexibility for the > > > > > implementation of integrity-focused LSMs based on eBPF. > > > > > > > > I've previously requested adding eBPF module measurements and signature > > > > verification support in IMA. There seemed to be some interest, but > > > > nothing has been posted. > > > > > > Hi Mimi > > > > > > for my use case, DIGLIM eBPF, IMA integrity verification is > > > needed until the binary carrying the eBPF program is executed > > > as the init process. I've been thinking to use an appended > > > signature to overcome the limitation of lack of xattrs in the > > > initial ram disk. > > > > I would still like to see xattrs supported in the initial ram disk. > > Assuming you're still interested in pursuing it, someone would need to > > review and upstream it. Greg? > > Me? How about the filesystem maintainers and developers? :) > > There's a reason we never added xattrs support to ram disks, but I can't > remember why... CPIO 'newc' format doesn't support xattrs. thanks, Mimi
Powered by blists - more mailing lists