From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from aserp1040.oracle.com ([141.146.126.69]:20836 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932182AbdKPACq (ORCPT ); Wed, 15 Nov 2017 19:02:46 -0500 Date: Thu, 16 Nov 2017 11:02:30 +1100 (AEDT) From: James Morris To: Patrick Ohly cc: Matthew Garrett , linux-integrity Subject: Re: IMA appraisal master plan? (was: Re: [PATCH V6] EVM: Add support for portable signature format) In-Reply-To: <1510770065.5979.21.camel@intel.com> Message-ID: References: <20171107151742.25122-1-mjg59@google.com> <1510766803.5979.17.camel@intel.com> <1510770065.5979.21.camel@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-integrity-owner@vger.kernel.org List-ID: On Wed, 15 Nov 2017, Patrick Ohly wrote: > I have some experience with SMACK, but not with Apparmor. At least with > SMACK the problem is that the LSM depends on integrity protection of > the xattrs, but the integrity protection itself depends on the LSM, so > there's a cycle. An attacker can much too easily make offline changes > which then defeat whatever IMA policy the system might be using. Isn't this what EVM is supposed to mitigate? Can you explain the offline attack in this scenario? -- James Morris