Messages in this thread | | | Date | Fri, 4 Jun 2010 10:57:51 +1000 (EST) | From | James Morris <> | Subject | Re: [PATCH 00/14] EVM |
| |
On Tue, 1 Jun 2010, Mimi Zohar wrote:
> SELinux, Smack, Capabilities, and IMA all use extended attributes. The > purpose of EVM is to detect offline tampering of these security extended > attributes.
One issue mentioned to me off-list is that if EVM is only protecting against offline attacks, why not just encrypt the entire volume ?
This would provide confidentiality and integrity protection for all data and metadata, rather than just integrity for xattr metadata.
- James -- James Morris <jmorris@namei.org>
| |