Messages in this thread | | | Date | Fri, 4 Jun 2010 11:56:59 +0500 | Subject | Re: [PATCH 00/14] EVM | From | Shaz <> |
| |
On Fri, Jun 4, 2010 at 5:57 AM, James Morris <jmorris@namei.org> wrote: > On Tue, 1 Jun 2010, Mimi Zohar wrote: > >> SELinux, Smack, Capabilities, and IMA all use extended attributes. The >> purpose of EVM is to detect offline tampering of these security extended >> attributes. > > One issue mentioned to me off-list is that if EVM is only protecting > against offline attacks, why not just encrypt the entire volume ?
Are you sure that EVM protects against offline attacks only?
Why and why not encrypt the whole volume?
> This would provide confidentiality and integrity protection for all data > and metadata, rather than just integrity for xattr metadata.
-- Shaz
| |