Messages in this thread | | | Date | Sat, 29 Apr 2006 00:48:27 +0400 | From | Michael Tokarev <> | Subject | Re: [ANNOUNCE] Release Digsig 1.5: kernel module for run-timeauthentication of binaries |
| |
Serge E. Hallyn wrote: > Quoting Arjan van de Ven (arjan@infradead.org): >>> A one time effort to write it *and sign it*. >> you don't sign nor need to sign perl or bash scripts. Why would a loader >> be written in ELF itself? There's absolutely no reason for that. > > Yup, that's an unfortunate shortcoming. We'd been wanting to re-post to > lkml for a long time to get ideas to fix that. > > I had an extension to digsig earlier which enabled signing shellscripts > using xattrs (just because it was a trivial task), but that's clearly > insufficient as it would catch "./myscript.pl" but not "perl > myscript.pl".
Another thing to do is to modify perl to verify signatures of the scripts it's executing, sign *that* perl binary, and disallow executing of unsigned perl scripts...
/mjt, who's joking only partially. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |