From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758921AbZBFU2a (ORCPT ); Fri, 6 Feb 2009 15:28:30 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752368AbZBFU2W (ORCPT ); Fri, 6 Feb 2009 15:28:22 -0500 Received: from hrndva-omtalb.mail.rr.com ([71.74.56.123]:58696 "EHLO hrndva-omtalb.mail.rr.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751775AbZBFU2V (ORCPT ); Fri, 6 Feb 2009 15:28:21 -0500 Date: Fri, 6 Feb 2009 14:31:43 -0600 From: "Serge E. Hallyn" To: Mimi Zohar Cc: linux-kernel@vger.kernel.org, Andrew Morton , James Morris , David Safford , Serge Hallyn , Mimi Zohar Subject: Re: [PATCH 2/7] integrity: IMA as an integrity service provider Message-ID: <20090206203143.GA17133@hallyn.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.15+20070412 (2007-04-11) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Mimi Zohar (zohar@linux.vnet.ibm.com): > IMA provides hardware (TPM) based measurement and attestation for > file measurements. As the Trusted Computing (TPM) model requires, > IMA measures all files before they are accessed in any way (on the > integrity_bprm_check, integrity_path_check and integrity_file_mmap > hooks), and commits the measurements to the TPM. Once added to the > TPM, measurements can not be removed. > > In addition, IMA maintains a list of these file measurements, which > can be used to validate the aggregate value stored in the TPM. The > TPM can sign these measurements, and thus the system can prove, to > itself and to a third party, the system's integrity in a way that > cannot be circumvented by malicious or compromised software. > > - alloc ima_template_entry before calling ima_store_template() > - log ima_add_boot_aggregate() failure > - removed unused IMA_TEMPLATE_NAME_LEN > - replaced hard coded string length with #define name > > Signed-off-by: Mimi Zohar Acked-by: Serge Hallyn