From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753969Ab3AQRZo (ORCPT ); Thu, 17 Jan 2013 12:25:44 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51089 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751804Ab3AQRZm (ORCPT ); Thu, 17 Jan 2013 12:25:42 -0500 Date: Thu, 17 Jan 2013 12:25:37 -0500 From: Vivek Goyal To: "Kasatkin, Dmitry" Cc: linux-kernel@vger.kernel.org, ebiederm@xmission.com, zohar@linux.vnet.ibm.com, pjones@redhat.com, hpa@zytor.com, dhowells@redhat.com, jwboyer@redhat.com, linux-security-module Subject: Re: [PATCH 0/3] ELF executable signing and verification Message-ID: <20130117172537.GA2237@redhat.com> References: <1358285695-26173-1-git-send-email-vgoyal@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jan 17, 2013 at 06:22:47PM +0200, Kasatkin, Dmitry wrote: [..] > > Currently it is expected to use these patches only for statically linked > > executables. No dynamic linking. In fact patches specifically disable > > calling interpreter. This does not prevent against somebody using dlopen() > > sutff. So don't sign binaries which do that. > > How dynamic linking and interpreter are related together? Well interpreter will do the dynamic linking automatically? So I blocked that. > > This is rather policy than enforcement. > Protection works only for statically linked binaries, because dynamic > libraries are not verified. Agreed. Thanks Vivek