[lkml]   [1997]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: signing a filesystem
   From: "Andrew G. Morgan" <>
Date: Sat, 11 Jan 1997 12:32:14 -0800 (PST)

> Who are you trying to protect your data against? What sort of resources
> is your adversary going to have?

The original suggestion was to be able to "sign" the filesystem, the threat
model was one of the following:

user process finds a way to modify the filesystem independently of
the filesystem

attacker shuts down the machine and boots a rogue kernel (OS) that
modifies the filesystem (replaces 'su' etc..)

system crashes and administrator wishes to establish which files'
data was damaged

> who has physical access to your disk while the kernel isn't running.
> However, is this a threat model which is most people will commonly see?

This is the sort of threat that a "public terminal" (universities/libraries
etc..) are subject to...

Note that if you can modify the filesystem, somehow bypassing the
kernel security checks, then one of the things you can do is to modify
the kernel so that it claims that the filesystem verified "A-OK", when
in fact the data on the filesystem was modified.

Hence, if your threat model is a "public terminal", the only thing you
can really do is to reload the system from scratch each time a
suspicious user sits down in front of it. If you're really clever, you
should be able to get that re-installation time to go fairly quickly.
(e.g., have a bootable CD-ROM which has a hard-disk image on it, and dd
a full system from the CD-ROM to the hard-disk). That's certainly what
I would suggest for someone trying to do a "public terminal room"

This doesn't work for the person who's afraid their laptop will get
stolen; but of course there you're probably concerned with data
confidentiality as much as you are data integrity, and it really is a
different problem altogether.

- Ted

 \ /
  Last update: 2005-03-22 13:38    [W:0.036 / U:0.712 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site