Re: [RFC PATCH v2] fw_lockdown: new micro LSM module to prevent loading unsigned firmware

[Mimi Zohar <zohar@linux.vnet.ibm.com>]

On Mon, 2017-11-13 at 20:51 +0100, Luis R. Rodriguez wrote:
> On Mon, Nov 13, 2017 at 02:36:47PM -0500, Mimi Zohar wrote:

> > Huh, I kind of lost you here.  What does "it" refer to in the above
> > sentence?  IMA is in the kernel.  So, who does what checks in
> > userspace?
> 
> Sorry I thought some checks were done in userspace, given that is clarified,
> what I meant is that say a device driver has a signing specification written
> out in the driver, should/can IMA use that on the LSM to verify the detached
> signature file for the firmware?

IMA-appraisal currently supports file signatures as extended
attributes.  Thiago Bauermann posted patches for including appended
signature support to IMA-appraisal.  If someone is interested in
adding detached signature support, they're welcome to do so.

> If it can be all done in kernel, it has me wondering if perhaps one option for
> IMA might be to do only vetting for these types of checks, where the info and
> description to appraise files is all in-kernel. IMA would not be required
> for other files.

We probably can defer this discussion until it is applicable.

Mimi