From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: Josh Boyer <jwboyer@kernel.org>, mcgrof@kernel.org
Cc: Harald Hoyer <harald@redhat.com>, Hannes Reinecke <hare@suse.de>,
Johannes Thumshirn <jthumshirn@suse.de>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Casey Schaufler <casey@schaufler-ca.com>,
ast@kernel.org, David Miller <davem@davemloft.net>,
jeyu@kernel.org, Alexander Viro <viro@zeniv.linux.org.uk>,
One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>,
Matthew Garrett <mjg59@srcf.ucam.org>,
Peter Jones <pjones@redhat.com>,
takahiro.akashi@linaro.org, David Howells <dhowells@redhat.com>,
Linux Wireless <linux-wireless@vger.kernel.org>,
Kalle Valo <kvalo@codeaurora.org>,
Seth Forshee <seth.forshee@canonical.com>,
johannes.berg@intel.com, linux-integrity@vger.kernel.org,
Hans de Goede <hdegoede@redhat.com>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
linux-security-module <linux-security-module@vger.kernel.org>,
"Linux-Kernel@Vger. Kernel. Org" <linux-kernel@vger.kernel.org>,
Kees Cook <keescook@chromium.org>,
Greg KH <gregkh@linuxfoundation.org>,
andresx7@gmail.com,
Linus Torvalds <torvalds@linux-foundation.org>,
luto@kernel.org, Justin Forbes <jforbes@redhat.com>,
Laura Abbott <labbott@redhat.com>
Subject: Re: [PATCH 3/6] firmware: differentiate between signed regulatory.db and other firmware
Date: Tue, 15 May 2018 08:43:39 -0400 [thread overview]
Message-ID: <1526388219.3937.137.camel@linux.vnet.ibm.com> (raw)
In-Reply-To: <CA+5PVA7QU0k91zvoBTAFzG+unkh-=-s9Lhk3hn3eTJhHo4ovCQ@mail.gmail.com>
On Tue, 2018-05-15 at 08:32 -0400, Josh Boyer wrote:
> One aspect that was always a concern to some is whether the firmware files
> were modified directly to have the signature attached to them. That may
> run afoul of the "no modification" license that most blobs are shipped
> under. Does IMA have the signatures for the files stored in xattrs or in
> some other detached manner?
They're stored as xattrs. RPM has support for including file
signatures in the RPM header.
Mimi
WARNING: multiple messages have this Message-ID (diff)
From: zohar@linux.vnet.ibm.com (Mimi Zohar)
To: linux-security-module@vger.kernel.org
Subject: [PATCH 3/6] firmware: differentiate between signed regulatory.db and other firmware
Date: Tue, 15 May 2018 08:43:39 -0400 [thread overview]
Message-ID: <1526388219.3937.137.camel@linux.vnet.ibm.com> (raw)
In-Reply-To: <CA+5PVA7QU0k91zvoBTAFzG+unkh-=-s9Lhk3hn3eTJhHo4ovCQ@mail.gmail.com>
On Tue, 2018-05-15 at 08:32 -0400, Josh Boyer wrote:
> One aspect that was always a concern to some is whether the firmware files
> were modified directly to have the signature attached to them. That may
> run afoul of the "no modification" license that most blobs are shipped
> under. Does IMA have the signatures for the files stored in xattrs or in
> some other detached manner?
They're stored as xattrs. ?RPM has support for including file
signatures in the RPM header.
Mimi
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: Josh Boyer <jwboyer@kernel.org>, mcgrof@kernel.org
Cc: Harald Hoyer <harald@redhat.com>, Hannes Reinecke <hare@suse.de>,
Johannes Thumshirn <jthumshirn@suse.de>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Casey Schaufler <casey@schaufler-ca.com>,
ast@kernel.org, David Miller <davem@davemloft.net>,
jeyu@kernel.org, Alexander Viro <viro@zeniv.linux.org.uk>,
One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>,
Matthew Garrett <mjg59@srcf.ucam.org>,
Peter Jones <pjones@redhat.com>,
takahiro.akashi@linaro.org, David Howells <dhowells@redhat.com>,
Linux Wireless <linux-wireless@vger.kernel.org>,
Kalle Valo <kvalo@codeaurora.org>,
Seth Forshee <seth.forshee@canonical.com>,
johannes.berg@intel.com, linux-integrity@vger.kernel.org,
Hans de Goede <hdegoede@redhat.com>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
linux-security-module <linux-security-module@vger.kernel.org>,
"Linux-Kernel@Vger. Kernel. Org" <linux-kernel@vger.kernel.org>,
Kees Cook <keescook@chromium.org>,
Greg KH <gregkh@linuxfoundation.org>,
andresx7@gmail.com,
Linus Torvalds <torvalds@linux-foundation.org>,
luto@kernel.org, Justin Forbes <jforbes@redhat.com>,
Laura Abbott <labbott@redhat.com>
Subject: Re: [PATCH 3/6] firmware: differentiate between signed regulatory.db and other firmware
Date: Tue, 15 May 2018 08:43:39 -0400 [thread overview]
Message-ID: <1526388219.3937.137.camel@linux.vnet.ibm.com> (raw)
In-Reply-To: <CA+5PVA7QU0k91zvoBTAFzG+unkh-=-s9Lhk3hn3eTJhHo4ovCQ@mail.gmail.com>
On Tue, 2018-05-15 at 08:32 -0400, Josh Boyer wrote:
> One aspect that was always a concern to some is whether the firmware files
> were modified directly to have the signature attached to them. That may
> run afoul of the "no modification" license that most blobs are shipped
> under. Does IMA have the signatures for the files stored in xattrs or in
> some other detached manner?
They're stored as xattrs. RPM has support for including file
signatures in the RPM header.
Mimi
next prev parent reply other threads:[~2018-05-15 12:44 UTC|newest]
Thread overview: 78+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-01 13:48 [PATCH 0/6] firmware: kernel signature verification Mimi Zohar
2018-05-01 13:48 ` Mimi Zohar
2018-05-01 13:48 ` [PATCH 1/6] firmware: permit LSMs and IMA to fail firmware sysfs fallback loading Mimi Zohar
2018-05-01 13:48 ` Mimi Zohar
2018-05-04 0:02 ` Luis R. Rodriguez
2018-05-04 0:02 ` Luis R. Rodriguez
2018-05-04 0:36 ` Mimi Zohar
2018-05-04 0:36 ` Mimi Zohar
2018-05-04 0:36 ` Mimi Zohar
2018-05-01 13:48 ` [PATCH 2/6] ima: prevent sysfs fallback firmware loading Mimi Zohar
2018-05-01 13:48 ` Mimi Zohar
2018-05-04 0:06 ` Luis R. Rodriguez
2018-05-04 0:06 ` Luis R. Rodriguez
2018-05-01 13:48 ` [PATCH 3/6] firmware: differentiate between signed regulatory.db and other firmware Mimi Zohar
2018-05-01 13:48 ` Mimi Zohar
2018-05-04 0:07 ` Luis R. Rodriguez
2018-05-04 0:07 ` Luis R. Rodriguez
2018-05-04 0:24 ` Mimi Zohar
2018-05-04 0:24 ` Mimi Zohar
2018-05-04 0:24 ` Mimi Zohar
2018-05-08 17:34 ` Luis R. Rodriguez
2018-05-08 17:34 ` Luis R. Rodriguez
2018-05-08 17:34 ` Luis R. Rodriguez
2018-05-09 11:30 ` Mimi Zohar
2018-05-09 11:30 ` Mimi Zohar
2018-05-09 11:30 ` Mimi Zohar
2018-05-09 19:15 ` Luis R. Rodriguez
2018-05-09 19:15 ` Luis R. Rodriguez
2018-05-09 19:15 ` Luis R. Rodriguez
2018-05-09 19:57 ` Mimi Zohar
2018-05-09 19:57 ` Mimi Zohar
2018-05-09 19:57 ` Mimi Zohar
2018-05-09 21:22 ` Luis R. Rodriguez
2018-05-09 21:22 ` Luis R. Rodriguez
2018-05-09 21:22 ` Luis R. Rodriguez
2018-05-09 22:06 ` Mimi Zohar
2018-05-09 22:06 ` Mimi Zohar
2018-05-09 22:06 ` Mimi Zohar
2018-05-09 23:48 ` Luis R. Rodriguez
2018-05-09 23:48 ` Luis R. Rodriguez
2018-05-09 23:48 ` Luis R. Rodriguez
2018-05-10 2:00 ` Mimi Zohar
2018-05-10 2:00 ` Mimi Zohar
2018-05-10 2:00 ` Mimi Zohar
2018-05-10 23:26 ` Luis R. Rodriguez
2018-05-10 23:26 ` Luis R. Rodriguez
2018-05-10 23:26 ` Luis R. Rodriguez
2018-05-11 5:00 ` Mimi Zohar
2018-05-11 5:00 ` Mimi Zohar
2018-05-11 5:00 ` Mimi Zohar
2018-05-11 21:52 ` Luis R. Rodriguez
2018-05-11 21:52 ` Luis R. Rodriguez
2018-05-11 21:52 ` Luis R. Rodriguez
2018-05-14 12:58 ` Mimi Zohar
2018-05-14 12:58 ` Mimi Zohar
2018-05-14 12:58 ` Mimi Zohar
2018-05-14 19:28 ` Luis R. Rodriguez
2018-05-14 19:28 ` Luis R. Rodriguez
2018-05-14 19:28 ` Luis R. Rodriguez
2018-05-15 2:02 ` Mimi Zohar
2018-05-15 2:02 ` Mimi Zohar
2018-05-15 2:02 ` Mimi Zohar
2018-05-15 3:26 ` Luis R. Rodriguez
2018-05-15 3:26 ` Luis R. Rodriguez
2018-05-15 3:26 ` Luis R. Rodriguez
2018-05-15 12:32 ` Josh Boyer
2018-05-15 12:32 ` Josh Boyer
2018-05-15 12:43 ` Mimi Zohar [this message]
2018-05-15 12:43 ` Mimi Zohar
2018-05-15 12:43 ` Mimi Zohar
2018-05-01 13:48 ` [PATCH 4/6] ima: coordinate with signed regulatory.db Mimi Zohar
2018-05-01 13:48 ` Mimi Zohar
2018-05-01 13:48 ` [PATCH 5/6] ima: verify kernel firmware signatures when using a preallocated buffer Mimi Zohar
2018-05-01 13:48 ` Mimi Zohar
2018-05-01 13:48 ` [RFC PATCH 6/6] ima: prevent loading firmware into a pre-allocated buffer Mimi Zohar
2018-05-01 13:48 ` Mimi Zohar
2018-05-04 0:10 ` Luis R. Rodriguez
2018-05-04 0:10 ` Luis R. Rodriguez
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1526388219.3937.137.camel@linux.vnet.ibm.com \
--to=zohar@linux.vnet.ibm.com \
--cc=andresx7@gmail.com \
--cc=ard.biesheuvel@linaro.org \
--cc=ast@kernel.org \
--cc=casey@schaufler-ca.com \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=gnomes@lxorguk.ukuu.org.uk \
--cc=gregkh@linuxfoundation.org \
--cc=harald@redhat.com \
--cc=hare@suse.de \
--cc=hdegoede@redhat.com \
--cc=jeyu@kernel.org \
--cc=jforbes@redhat.com \
--cc=johannes.berg@intel.com \
--cc=jthumshirn@suse.de \
--cc=jwboyer@kernel.org \
--cc=keescook@chromium.org \
--cc=kvalo@codeaurora.org \
--cc=labbott@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mcgrof@kernel.org \
--cc=mjg59@srcf.ucam.org \
--cc=pjones@redhat.com \
--cc=seth.forshee@canonical.com \
--cc=takahiro.akashi@linaro.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.