Messages in this thread | | | Subject | Re: Firmware signing -- Re: [PATCH 00/27] security, efi: Add kernel lockdown | From | Mimi Zohar <> | Date | Wed, 08 Nov 2017 15:01:09 -0500 |
| |
> > Or reflect that IMA-appraisal, if enabled, will enforce firmware being > > validly signed. > > But FWICT lockdown is a built-in kernel thingy, unless lockdown implies IMA > it would not be the place to refer to it. > > It seems the documentation was proposed to help users if an error was caught. > That error should cover only what is being addressed in code on the kernel.
Enabling "lockdown" needs to take into account IMA-appraisal to prevent breaking systems with it enabled.
An IMA builtin "secure_boot" policy was already upstreamed (commit 503ceaef8e2e "ima: define a set of appraisal rules requiring file signatures"). An additional patch, automatically enables the "secure_boot" policy in "lockdown" mode.
Refer to this discussion and patch: http://kernsec.org/pipermail/linux-security-module-archive/2017-October/003913.html http://kernsec.org/pipermail/linux-security-module-archive/2017-October/003910.html
thanks,
Mimi
| |