From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: Eric Paris <eparis@parisplace.org>
Cc: Vivek Goyal <vgoyal@redhat.com>,
linux kernel mailing list <linux-kernel@vger.kernel.org>,
LSM List <linux-security-module@vger.kernel.org>
Subject: Re: IMA: How to manage user space signing policy with others
Date: Thu, 28 Feb 2013 20:49:04 -0500 [thread overview]
Message-ID: <1362102544.9158.35.camel@falcor1> (raw)
In-Reply-To: <CACLa4pum7kXK+7+8ceVSuQsKDCFebdgGVYRTMKH9GQarqCEgMQ@mail.gmail.com>
On Thu, 2013-02-28 at 17:20 -0500, Eric Paris wrote:
> On Thu, Feb 28, 2013 at 4:35 PM, Vivek Goyal <vgoyal@redhat.com> wrote:
> > On Thu, Feb 28, 2013 at 02:23:39PM -0500, Mimi Zohar wrote:
>
> I think just a second for both of you to step back and see a slightly
> larger picture/problem might help.
>
> This is a weird case where Vivek does not trust root to make the
> policy decision. If the box is configured for secure boot, it needs
> to make these decisions no matter what the admin wants. This is why
> he talks about trying to merge multiple competing policies. The
> current IMA policy is controlled by whomever can first write to the
> ima policy file interface. Vivek does not want an admin to be able to
> overwrite the secureboot policy. So I get why he thinks changes may
> be needed to support this use case.
Nobody is saying that changes aren't necessary.
> The ima_tcb policy was meant to be larger than needed to determine a
> trusted computing base, but it is clearly not a superset of what he is
> hoping to accomplish.
The 'ima_tcb' policy is for measurement and attestation. The policy
being discussed here is the 'ima_appraise_tcb' used for enforcing local
file integrity.
> So how do we take a system where the admin/software has some control
> over the integrity policy (as it is today?) and the kernel/system
> itself also has control (as Vivek wants it)?
> It seems unsolved with what we have today....
Right, and merging policies won't work. I see where you're going with
this...
thanks!
Mimi
next prev parent reply other threads:[~2013-03-01 1:49 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-28 15:13 IMA: How to manage user space signing policy with others Vivek Goyal
2013-02-28 18:51 ` Vivek Goyal
2013-02-28 20:30 ` Mimi Zohar
2013-02-28 20:57 ` Vivek Goyal
2013-03-01 1:42 ` Mimi Zohar
2013-02-28 19:23 ` Mimi Zohar
2013-02-28 20:08 ` Vivek Goyal
2013-03-01 1:45 ` Mimi Zohar
2013-02-28 21:35 ` Vivek Goyal
2013-02-28 22:20 ` Eric Paris
2013-03-01 1:49 ` Mimi Zohar [this message]
2013-03-01 12:15 ` Mimi Zohar
2013-03-01 15:28 ` Vivek Goyal
2013-03-01 18:40 ` Vivek Goyal
2013-03-01 19:39 ` Mimi Zohar
2013-03-01 21:33 ` Vivek Goyal
2013-03-03 21:42 ` Mimi Zohar
2013-03-04 15:29 ` Vivek Goyal
2013-03-04 17:46 ` Vivek Goyal
2013-03-04 18:59 ` Mimi Zohar
2013-03-04 19:15 ` Vivek Goyal
2013-03-05 1:21 ` Mimi Zohar
2013-03-05 15:18 ` Vivek Goyal
2013-03-05 20:40 ` Mimi Zohar
2013-03-05 21:53 ` Vivek Goyal
2013-03-06 15:42 ` Mimi Zohar
2013-03-06 23:55 ` Vivek Goyal
2013-03-07 1:39 ` Mimi Zohar
2013-03-07 14:36 ` Vivek Goyal
2013-03-07 15:40 ` Mimi Zohar
2013-03-07 15:53 ` Vivek Goyal
2013-03-07 17:53 ` Kasatkin, Dmitry
2013-03-07 21:56 ` Vivek Goyal
2013-03-08 8:09 ` Kasatkin, Dmitry
2013-03-08 15:40 ` Vivek Goyal
2013-03-06 15:54 ` Vivek Goyal
2013-03-06 22:48 ` Mimi Zohar
2013-03-06 23:38 ` Vivek Goyal
2013-03-07 13:38 ` Mimi Zohar
2013-03-07 14:57 ` Vivek Goyal
2013-03-04 19:19 ` Eric Paris
2013-03-04 21:47 ` Vivek Goyal
2013-03-01 2:17 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1362102544.9158.35.camel@falcor1 \
--to=zohar@linux.vnet.ibm.com \
--cc=eparis@parisplace.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox