lkml.org 
[lkml]   [2008]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 0/4] integrity
On Wed, 12 Nov 2008 22:47:10 -0500
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> The Linux Integrity Module (LIM) Framework provides hooks
> for modules to perform collection, appraisal, and storage
> of system integrity measurements. One such module, IMA,
> collects measurements of file data, maintains this list
> in the kernel, and if available, stores (extends) the
> measurements into a hardware TPM. These measurements are
> collected, appraised, and stored before any access
> (read or execute) to the data, so that malicious code or
> data cannot remove or cover up its own measurement, to avoid
> detection. If the measurements are anchored in a TPM, the
> TPM can sign the measurements, for proof of integrity
> to a third party, such as in enterprise client management.
>
> Integrity measurement is complementary to LSM mandatory
> access control, which can be used to protect the integrity
> of system files. Integrity measurement policies can take
> advantage of LSM labels in deciding what to measure and
> to detect when the protection fails, with hardware strength.

This all looks quite mergeable to me, although I am far from being an
expert on security things.

One thing which I cannot say, and which is quite important: how useful
will all of this be to our users? Are people asking for it? Are
people likely to enable and use it? Are they even likely to understand
it? ;) Are any large/important customers asking for it? Are distros
likely to enable and support it?

etc?


\
 
 \ /
  Last update: 2008-11-14 23:21    [W:0.098 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site