lkml.org 
[lkml]   [2012]   [Jun]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 00/23] Crypto keys and module signing
From
On Tue, Jun 5, 2012 at 4:37 PM, David Howells <dhowells@redhat.com> wrote:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
>> As the signature would be stored as an extended attribute, we wouldn't
>> need to pass it.  Unfortunately not all filesystems have xattr support,
>> nor do all of the package installation mechanims.  The benefit of
>> storing the signature as an extended attribute, however, is that there
>> is a consistent mechanism for verifying file data integrity for all
>> files, not only ELF.
>
> We also want to be able to do module signature verification with CONFIG_IMA=n.

Sure. In the patchset I sent some time ago, signature verification
does not require CONFIG_IMA=y.
modprobe reads signature from xattr or .sig file and pass it as kernel
module parameter.

- Dmitry


>
> David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2012-06-05 17:21    [W:0.067 / U:1.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site