Messages in this thread | | | From | Rusty Russell <> | Subject | Re: [PATCH 0/3] ELF executable signing and verification | Date | Tue, 22 Jan 2013 14:52:19 +1030 |
| |
Vivek Goyal <vgoyal@redhat.com> writes: > Hi, > > This is a very crude RFC for ELF executable signing and verification. This > has been done along the lines of module signature verification.
Yes, but I'm the first to admit that's the wrong lines.
The reasons we didn't choose that for module signatures: 1) I was unaware of it, 2) We didn't have a file descriptor in the module syscall, and 3) It needs attributes, and we don't understand xattrs in cpio (though bsdcpio does).
#1 and #2 are no longer true; #3 is a simple matter of coding.
Since signing binaries is the New Hotness, I'd prefer not to keep reiterating this discussion every month. Let's beef up IMA instead...
Thanks, Rusty.
| |