Messages in this thread | | | Date | Wed, 14 Mar 2007 11:48:42 -0700 | From | Seth Arnold <> | Subject | Re: [RFC] [Patch 1/1] IBAC Patch |
| |
On Wed, Mar 14, 2007 at 07:25:26AM -0400, Mimi Zohar wrote: > It's a little bit of both. :-) Initially it was written to help me with
:)
> implementing and testing the integrity provider. But it could definitely stand > on it's own. As Serge Hallyn commented http://lkml.org/lkml/2007/3/13/220, by > adding the mmap hook, IBAC could replace the LSM aspect of digsig and a gpg > based integrity provider, could be written, instead of EVM, which is TPM based.
Thanks.
> > > + if (status != INTEGRITY_PASS) { /* FAIL | NO_LABEL */ > > > + if (!is_kernel_thread(current)) { > > > > Please remind me why kernel threads are exempt? > > You really don't want to prevent kernel threads from working. Nasty things > happen.
But under what conditions would a kernel thread not pass integrity? I guess if it doesn't have an associated dentry... or the dentry refers to something else? (What does knfsd do -- it is started by a userland program which causes the kernel to start up some tasks for NFS..)
> For integrity_measure(), EVM calls IMA, if enabled, to extend the > measurement list with the hash value it provides. In most cases, EVM > has already calculated the hash value, when it was called to verify the > data. integrity_measure() is not meant to be intrusive, so it is defined > as void.
Oh, ok, thanks.
> Thank you for your comments.
My pleasure, thanks for the quick responses. [unhandled content-type:application/pgp-signature] | |