Re: [PATCH 00/12] One more attempt at useful kernel lockdown

H. Peter Anvin
2013-09-10T23:58:27Z

On 09/10/2013 04:55 PM, Mimi Zohar wrote:
>>
>> What would the deliverables be from the hardware vendor and what tools
>> would you expect them to need on their end?
>
> The package installer needs to not only install files, but file metadata
> as well. Elena Reshetova (Intel) has already added rpm hooks to write
> security xattrs. The next step, yet to be done, is to include and write
> the signatures as part of the rpm install process.
>

That's a total non-option.

There needs to be something that can be done even on a Windows box by a
largely untrained release engineer if we're going to have a prayer of
getting this supported.

So, there is your answer why not.

-hpa