Re: [RFC PATCH 0/6][v3] ima: Support a mode to appraise signedfiles only

[Mimi Zohar]

On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote:
> Hi,
> 
> Currently ima appraises all the files as specified by the rule.

Currently IMA appraises files based on policy.

>  So
> if one wants to create a system where only few executables are
> signed, that system will not work with IMA.

This statement misrepresents the IMA policy.  You can definitely define
a policy that only measures/appraises a few specific files.  In your
usecase scenario, you are not willing to rely on LSM labels.  Policy
rules can also be based on file owner.  We could also add support for
gid.

> With secureboot, one needs to disable kexec so that unsigned kernels
> can't be booted. To avoid this problem, it was proposed that sign
> /sbin/kexec binary and if signatures are verified successfully, give
> an special capability to the /sbin/kexec process. And in secureboot
> mode processes with that special capability can invoke sys_kexec()
> system call.

Please add here that you then rely on /sbin/kexec to verify the
integrity of the kernel image.

thanks,

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/