From: Randy Dunlap <rdunlap@infradead.org>
To: Fan Wu <wufan@linux.microsoft.com>,
corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org,
serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org,
axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org,
eparis@redhat.com, paul@paul-moore.com
Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-fscrypt@vger.kernel.org, linux-block@vger.kernel.org,
dm-devel@lists.linux.dev, audit@vger.kernel.org,
linux-kernel@vger.kernel.org,
Deven Bowers <deven.desai@linux.microsoft.com>
Subject: Re: [RFC PATCH v14 16/19] ipe: enable support for fs-verity as a trust provider
Date: Wed, 6 Mar 2024 16:02:26 -0800 [thread overview]
Message-ID: <cb5c1c98-3502-401b-b554-bc141c73f835@infradead.org> (raw)
In-Reply-To: <1709768084-22539-17-git-send-email-wufan@linux.microsoft.com>
On 3/6/24 15:34, Fan Wu wrote:
> +config IPE_PROP_FS_VERITY
> + bool "Enable property for fs-verity files"
> + depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES
> + help
> + This option enables the usage of properties "fsverity_signature"
> + and "fsverity_digest". These properties evaluates to TRUE when
evaluate
> + a file is fsverity enabled and with a signed digest or its
> + digest matches the supplied value in the policy.
--
#Randy
next prev parent reply other threads:[~2024-03-07 0:02 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-06 23:34 [RFC PATCH v14 00/19] Integrity Policy Enforcement LSM (IPE) Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 01/19] security: add ipe lsm Fan Wu
2024-03-11 14:25 ` Roberto Sassu
2024-03-11 18:10 ` Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 02/19] ipe: add policy parser Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 03/19] ipe: add evaluation loop Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 04/19] ipe: add LSM hooks on execution and kernel read Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 05/19] initramfs|security: Add a security hook to do_populate_rootfs() Fan Wu
2024-03-11 14:53 ` Roberto Sassu
2024-03-11 18:34 ` Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 06/19] ipe: introduce 'boot_verified' as a trust provider Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 07/19] security: add new securityfs delete function Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 08/19] ipe: add userspace interface Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 09/19] uapi|audit|ipe: add ipe auditing support Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 10/19] ipe: add permissive toggle Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 11/19] block|security: add LSM blob to block_device Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 12/19] dm: add finalize hook to target_type Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 13/19] dm verity: consume root hash digest and signature data via LSM hook Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 14/19] ipe: add support for dm-verity as a trust provider Fan Wu
2024-03-07 0:01 ` Randy Dunlap
2024-03-06 23:34 ` [RFC PATCH v14 15/19] fsverity: consume builtin signature via LSM hook Fan Wu
2024-03-12 2:57 ` Eric Biggers
2024-03-12 3:07 ` Eric Biggers
2024-03-12 13:12 ` Paul Moore
2024-03-12 18:14 ` Fan Wu
2024-03-12 18:51 ` Casey Schaufler
2024-03-12 19:08 ` Fan Wu
2024-03-12 20:07 ` Paul Moore
2024-03-12 18:33 ` Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 16/19] ipe: enable support for fs-verity as a trust provider Fan Wu
2024-03-07 0:02 ` Randy Dunlap [this message]
2024-03-06 23:34 ` [RFC PATCH v14 17/19] scripts: add boot policy generation program Fan Wu
2024-03-07 0:05 ` Randy Dunlap
2024-03-06 23:34 ` [RFC PATCH v14 18/19] ipe: kunit test for parser Fan Wu
2024-03-06 23:34 ` [RFC PATCH v14 19/19] documentation: add ipe documentation Fan Wu
2024-03-09 1:14 ` [RFC PATCH v14 00/19] Integrity Policy Enforcement LSM (IPE) Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cb5c1c98-3502-401b-b554-bc141c73f835@infradead.org \
--to=rdunlap@infradead.org \
--cc=agk@redhat.com \
--cc=audit@vger.kernel.org \
--cc=axboe@kernel.dk \
--cc=corbet@lwn.net \
--cc=deven.desai@linux.microsoft.com \
--cc=dm-devel@lists.linux.dev \
--cc=ebiggers@kernel.org \
--cc=eparis@redhat.com \
--cc=jmorris@namei.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=serge@hallyn.com \
--cc=snitzer@kernel.org \
--cc=tytso@mit.edu \
--cc=wufan@linux.microsoft.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.