Re: [RFC 0/1] ima/evm: signature verification support using asymmetric keys

[David Howells <dhowells@redhat.com>]

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> David, are you ok with how support for asymmetric keys is being added to
> EVM/IMA-appraisal for verifying signatures?  Any comments?

I would also like to have a look at altering your trusted key type[*] to be a
subtype of asymmetric keys so that the asymmetric key type can cover keys from
more sources:

	- Compiled-in keys.
	- Keys from UEFI db.
	- Keys from TPM (ie. the trusted key stuff).
	- Keys loaded by the administrator _if_ they are validated by a key the
	  kernel already has.
	
[*] I believe that that's your asymmetric key type and that your encrypted key
    type is your symmetric key type.

To support this, it may be necessary to make it possible to make the "trusted"
key type name a synonym of the "asymmetric" key type name in some way.

I also have some patches to divorce the module signing public keyring stuff
from module signing and make it a more generic system keyring of trusted keys
that can be used for other purposes (such as IMA and verifying additional
keys) that I shall post shortly.

On top of those patches, I have a series of patches to permit extra keys to be
added from signed PE binaries that can be found here:

http://git.kernel.org/?p=linux/kernel/git/dhowells/linux-modsign.git;a=shortlog;h=refs/heads/devel-pekey

David