lkml.org 
[lkml]   [2007]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [Patch 3/7] integrity: EVM as an integrity service provider
    From
    Date
    On Sun, 2007-03-25 at 12:13 +0000, Pavel Machek wrote:
    > > > + The Extended Verification Module is an integrity provider.
    > > > + An extensible set of extended attributes, as defined in
    > > > + /etc/evm.conf, are HMAC protected against modification
    > > > + using the TPM's KERNEL ROOT KEY, if configured, or with a
    > > > + pass-phrase. Possible extended attributes include authenticity,
    > > > + integrity, and revision level.
    >
    > What is identity provider good for? Can you explain it a bit more, or
    > perhaps point to Doc*/ somewhere?
    > Pavel

    There are some papers and related userspace code at
    http://www.research.ibm.com/gsal/tcpa
    which describe the architecture in more detail, but basically this
    integrity provider is designed to complement mandatory access control
    systems like selinux and slim. Such systems can protect a running system
    against on-line attacks, but do not protect against off-line attacks
    (booting Knoppix and changing executables or their selinux labels), or
    against attacks which find weaknesses in the kernel or the LSM module
    itself.

    Using a TPM or passphrase, EVM can verify the integrity of all files
    (including the kernel and initrd) and their labels before they are
    referenced. Using a TPM, EVM/IMA can attest to the integrity of all files
    to a third party, even if the kernel or modules have been compromised.
    (An attack can block the attestation, but cannot forge valid TPM
    signatures.)

    In response to customer demand, we are actively working to develop and
    test this attestation in enterprise server environments, integrated
    with both selinux and AppArmor.

    dave


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-03-26 19:59    [W:0.021 / U:0.644 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site