From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from aserp1040.oracle.com ([141.146.126.69]:41951 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751004AbdKSUsR (ORCPT ); Sun, 19 Nov 2017 15:48:17 -0500 Date: Mon, 20 Nov 2017 07:47:55 +1100 (AEDT) From: James Morris To: Roberto Sassu cc: Mimi Zohar , Matthew Garrett , Patrick Ohly , linux-integrity , linux-security-module , Silviu Vlasceanu Subject: Re: IMA appraisal master plan? In-Reply-To: Message-ID: References: <20171107151742.25122-1-mjg59@google.com> <1510766803.5979.17.camel@intel.com> <1510770065.5979.21.camel@intel.com> <1510798382.3711.389.camel@linux.vnet.ibm.com> <8bbaea89-336c-d14b-2ed8-44cd0a0d3ed1@huawei.com> <1510837595.3711.420.camel@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-integrity-owner@vger.kernel.org List-ID: On Fri, 17 Nov 2017, Roberto Sassu wrote: > LSMs are responsible to enforce a security policy at run-time, while > IMA/EVM protect data and metadata against offline attacks. In my view, IMA can also protect against making an online attack persistent across boots, and that would be the most compelling use of it for many general purpose applications. -- James Morris