From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752455Ab3A1S4b (ORCPT ); Mon, 28 Jan 2013 13:56:31 -0500 Received: from mx1.redhat.com ([209.132.183.28]:38621 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751709Ab3A1S43 (ORCPT ); Mon, 28 Jan 2013 13:56:29 -0500 Date: Mon, 28 Jan 2013 13:56:25 -0500 From: Vivek Goyal To: "Kasatkin, Dmitry" Cc: Mimi Zohar , dhowells@redhat.com, jmorris@namei.org, linux-security-module@vger.kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [RFC 1/1] ima: digital signature verification using asymmetric keys Message-ID: <20130128185625.GC5868@redhat.com> References: <53febcf9f13e59a1ddd8f8c9826cadbe663f2295.1358246017.git.dmitry.kasatkin@intel.com> <1358895228.2408.14.camel@falcor1> <20130125210157.GA13152@redhat.com> <20130128151527.GA5868@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jan 28, 2013 at 05:20:20PM +0200, Kasatkin, Dmitry wrote: [..] > > Ok. I am hoping that it will be more than the kernel command line we > > support. In the sense that for digital signatures one needs to parse > > the signature, look at what hash algorithm has been used and then > > collect the hash accordingly. It is little different then IMA requirement > > of calculating one pre-determine hash for all files. > > Yes... It is obvious. It's coming. > But in general, signer should be aware of requirements and limitation > of the platform. > It is not really a problem... One more question. I specified "ima_appraise_tcb" on kernel command line and I had an unbootable system. It refused to run "init" as it was not labeled/signed. Is there any policy/way where it appraises only signed files and does not refuse to open/execute unsigned ones. Thanks Vivek