From: David Howells <dhowells@redhat.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: dhowells@redhat.com, dmitry.kasatkin@intel.com,
linux-kernel@vger.kernel.org, keyrings@linux-nfs.org,
linux-security-module@vger.kernel.org,
linux-crypto@vger.kernel.org
Subject: Re: [PATCH 2/3] KEYS: Separate the kernel signature checking keyring from module signing
Date: Thu, 17 Jan 2013 21:20:28 +0000 [thread overview]
Message-ID: <30183.1358457628@warthog.procyon.org.uk> (raw)
In-Reply-To: <1358449049.2689.87.camel@falcor1>
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> Lets assume accepting built in keys should is acceptable for all use
> cases. Adding additional keys from userspace is probably not acceptable
> for all use cases. Those keys should be added to specific 'trusted'
> keyrings.
>
> EVM and IMA-appraisal have separate keyrings for this reason. I might
> be interested in allowing third party packages to be installed and
> executed, but that doesn't imply that a security.evm extended attribute,
> signed by a third party application, is acceptable.
We should probably look at using the capability of X.509 certificates to
indicate what a key may be used for and noting that in the public_key struct.
David
next prev parent reply other threads:[~2013-01-17 21:20 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-17 18:03 [PATCH 1/3] KEYS: Load *.x509 files into kernel keyring David Howells
2013-01-17 18:04 ` [PATCH 2/3] KEYS: Separate the kernel signature checking keyring from module signing David Howells
2013-01-17 18:57 ` Mimi Zohar
2013-01-17 21:20 ` David Howells [this message]
2013-01-17 18:04 ` [PATCH 3/3] KEYS: Add a 'trusted' flag and a 'trusted only' flag David Howells
2013-01-30 8:29 ` Kasatkin, Dmitry
2013-01-30 10:32 ` David Howells
2013-02-06 22:18 ` Kasatkin, Dmitry
2013-01-17 18:44 ` [PATCH 1/3] KEYS: Load *.x509 files into kernel keyring Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=30183.1358457628@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=dmitry.kasatkin@intel.com \
--cc=keyrings@linux-nfs.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.