lkml.org 
[lkml]   [2006]   [Apr]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [ANNOUNCE] Release Digsig 1.5: kernel module for run-time authentication of binaries
Quoting Nix (nix@esperi.org.uk):
> On 23 Apr 2006, Ulrich Drepper prattled cheerily:
> > On 4/23/06, Arjan van de Ven <arjan@infradead.org> wrote:
> >> does this also prevent people writing their own elf loader in a bit of
> >> perl and just mmap the code ?
> >
> > You will never get 100% protection from a mechanism like signed
> > binaries. What you can get in collaboration with other protections
> > like SELinux is another layer of security. That's good IMO. Not
> > being able to slide in modified and substituted binaries which then
> > would be marked to get certain privileges is a plus.
>
> Of course in order to use it in conjunction with SELinux right now you
> need LSM stacking, which is a nest of dragons in itself (if not used
> very carefully stacking can weaken security rather than strengthening
> it...)

Perhaps. On the other hand, combining selinux with digsig you get:

1. selinux integrity controls on crucial digsig files, which
digsig does not (and should not) protect itself
2. digsig controls over selinux entry types. So now you can
protect domain transitions with small, verifiable entry points
which are then signed to boot.

> `Stripped-down firewalls' on its own is a big niche.

Every home should have one.

> Combine it with SELinux, exec-shield, FORTIFY_SOURCE, -fstack-protector
> and, say, a COWed filesystem read off a CD and reset with every boot,
> and you start to get a bit less insecure than you would otherwise be.

Sounds like a good basis for a new tiny distro.

-serge
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-04-26 05:45    [W:0.073 / U:0.512 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site