Re: [ANNOUNCE] Release Digsig 1.5: kernel module for run-timeauthentication of binaries

["Serge E. Hallyn" <serue@us.ibm.com>]

Quoting Christoph Hellwig (hch@infradead.org):
> On Fri, Apr 28, 2006 at 11:09:14AM -0500, Serge E. Hallyn wrote:
> > BS - you can stack another LSM to prevent that.
> > 
> > Or, stack it with SELinux.  I've tested that combination before with no
> > problems.
> 
> The real question here is why use lsm at all?  lsm sounds like the wrong
> set of hooks for something like this.  If you look at the hooks they are
> clearly for access control handling, which this isn't at all.  I bet
> your code would be a lot simpler if you just hooked into the right places
> directly.  and made it controllable by selinux or $lsm.

The evm code (which should be released soon) introduces an integrity
subsystem, using TPM.  The crypto part of digsig could become another
user of that subsystem.

At that point like you say selinux could mark types which can cause
domain transitions as needing to be signed, and, if lsm's not dead,
other lsm's could use it other ways if they like.

thanks,
-serge