lkml.org 
[lkml]   [2019]   [Aug]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v12 00/11] Appended signatures support for IMA appraisal
    From
    Date
    On 6/27/19 7:19 PM, Thiago Jung Bauermann wrote:
    > On the OpenPOWER platform, secure boot and trusted boot are being
    > implemented using IMA for taking measurements and verifying signatures.
    > Since the kernel image on Power servers is an ELF binary, kernels are
    > signed using the scripts/sign-file tool and thus use the same signature
    > format as signed kernel modules.
    >
    > This patch series adds support in IMA for verifying those signatures.
    > It adds flexibility to OpenPOWER secure boot, because it allows it to boot
    > kernels with the signature appended to them as well as kernels where the
    > signature is stored in the IMA extended attribute.

    I know this is pretty late, but I just wanted to let you know that I
    tested this patch set on x86_64 with QEMU.

    That is, I enrolled a key to _ima keyring, signed my kernel and modules
    with appended signatures (with scripts/sign-file), set the IMA policy to
    appraise and measure my kernel and modules. Also tested kexec appraisal.

    You can add my tested-by if you'd like.

    -Jordan

    \
     
     \ /
      Last update: 2019-08-27 00:47    [W:5.049 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site