lkml.org 
[lkml]   [2007]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Patch 3/7] integrity: EVM as an integrity service provider
Hi!

> > > > + The Extended Verification Module is an integrity provider.
> > > > + An extensible set of extended attributes, as defined in
> > > > + /etc/evm.conf, are HMAC protected against modification
> > > > + using the TPM's KERNEL ROOT KEY, if configured, or with a
> > > > + pass-phrase. Possible extended attributes include authenticity,
> > > > + integrity, and revision level.
> >
> > What is identity provider good for? Can you explain it a bit more, or
> > perhaps point to Doc*/ somewhere?
>
> There are some papers and related userspace code at
> http://www.research.ibm.com/gsal/tcpa
> which describe the architecture in more detail, but basically this
> integrity provider is designed to complement mandatory access control
> systems like selinux and slim. Such systems can protect a running system
> against on-line attacks, but do not protect against off-line attacks
> (booting Knoppix and changing executables or their selinux labels), or
> against attacks which find weaknesses in the kernel or the LSM module
> itself.

Thanks. Can this go to Doc*/ somewhere?

...but... If I can attack your system using knoppix, I can get at your
data, already, right? So you'll need to encrypt your data, anyway?

> Using a TPM or passphrase, EVM can verify the integrity of all files
> (including the kernel and initrd) and their labels before they are

How does passphrase work here?

...so you have your data encrypted, and you have bootloader that
verifies kernel/initrd (you need that, anyway). Because you data are
encrypted, knoppix attack will not work... assuming crypto does some
integrity checks, but IIRC crypto needs to do that.

Pavel,
who is afraid, that this code will come back and bite him. He has
nightmares of opening PS4 box as a christmas gift, then not being able
to hack his new hardware.

--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-03-27 18:17    [W:0.043 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site