From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 253A4C04EBF for ; Tue, 4 Dec 2018 22:18:06 +0000 (UTC) Received: from lists.ozlabs.org (lists.ozlabs.org [203.11.71.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9BB5F2082B for ; Tue, 4 Dec 2018 22:18:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9BB5F2082B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=namei.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 438bpg4YrPzDqLj for ; Wed, 5 Dec 2018 09:18:03 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; dmarc=none (p=none dis=none) header.from=namei.org Authentication-Results: lists.ozlabs.org; spf=none (mailfrom) smtp.mailfrom=namei.org (client-ip=65.99.196.166; helo=namei.org; envelope-from=jmorris@namei.org; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=none (p=none dis=none) header.from=namei.org X-Greylist: delayed 898 seconds by postgrey-1.36 at bilbo; Wed, 05 Dec 2018 09:15:29 AEDT Received: from namei.org (namei.org [65.99.196.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 438blj4mzqzDqYB for ; Wed, 5 Dec 2018 09:15:29 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by namei.org (8.14.4/8.14.4) with ESMTP id wB4Lxkjh022787; Tue, 4 Dec 2018 21:59:46 GMT Date: Wed, 5 Dec 2018 08:59:45 +1100 (AEDT) From: James Morris To: Thiago Jung Bauermann Subject: Re: [PATCH v8 00/14] Appended signatures support for IMA appraisal In-Reply-To: <20181116200712.14154-1-bauerman@linux.ibm.com> Message-ID: References: <20181116200712.14154-1-bauerman@linux.ibm.com> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Herbert Xu , linux-doc@vger.kernel.org, Dmitry Kasatkin , Jonathan Corbet , linux-kernel@vger.kernel.org, Mimi Zohar , "David S. Miller" , David Howells , "AKASHI, Takahiro" , linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, Jessica Yu , linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, David Woodhouse , "Serge E. Hallyn" Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" On Fri, 16 Nov 2018, Thiago Jung Bauermann wrote: > On the OpenPOWER platform, secure boot and trusted boot are being > implemented using IMA for taking measurements and verifying signatures. > Since the kernel image on Power servers is an ELF binary, kernels are > signed using the scripts/sign-file tool and thus use the same signature > format as signed kernel modules. > > This patch series adds support in IMA for verifying those signatures. Are you saying you use IMA to verify kernels during boot? From a Linux bootloader? > It adds flexibility to OpenPOWER secure boot, because it allows it to boot > kernels with the signature appended to them as well as kernels where the > signature is stored in the IMA extended attribute. Just to clarify, with these patches, IMA will be able to verify the native form of signed kernel modules? i.e. without xattrs at all, and this will work with existing signed modules? -- James Morris