Re: [PATCH 0/4] integrity

[david safford <safford@watson.ibm.com>]

On Fri, 2008-11-14 at 14:18 -0800, Andrew Morton wrote:
> On Wed, 12 Nov 2008 22:47:10 -0500
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> 
> > The Linux Integrity Module (LIM) Framework provides hooks
> > ...
> This all looks quite mergeable to me, although I am far from being an
> expert on security things.
> 
> One thing which I cannot say, and which is quite important: how useful
> will all of this be to our users?  Are people asking for it?  Are
> people likely to enable and use it?  Are they even likely to understand
> it?  ;) Are any large/important customers asking for it?  Are distros
> likely to enable and support it?

LIM/IMA's maintenance of a TPM hardware anchored file measurement 
list is fundamental to the Trusted Computing Group's standards 
efforts. Several projects have implemented the TNC (Trusted Network
Connect) and PTS (Platform Trust Services) standards (see below). 
There are three demo packaged distros which have integrated these
apps, two of which are government funded (EU and US), with definite
customer interest. We are working with the RHEL team to provide
a supported, patched kernel for HAP. All of these so far have used
the old LSM based IMA, and have asked for a supported, upstreamed 
implementation, with the ability to work with SELinux.

Standards
http://www.trustedcomputinggroup.org

TNC/PTS Projects:
http://tnc.inform.fh-hannover.de/wiki/index.php/Main_Page  (server)
http://sourceforge.net/projects/libtnc   (library)
http://hostap.epitest.fi/wpa_supplicant/wpa_supplicant   (client)
http://sourceforge.jp/projects/openpts   (client and server)

Test Distros:
http://unit.aist.go.jp/itri/knoppix/index-en.html   (trusted Knoppix)
http://www.nsa.gov/ia/industry/HAP/   (US)
http://www.opentc.net   (EU)