lkml.org 
[lkml]   [2013]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC 2/2] initramfs with digital signature protection
On Tue, Feb 05, 2013 at 06:19:26PM +0000, Matthew Garrett wrote:
> On Tue, Feb 05, 2013 at 02:34:50PM +0200, Dmitry Kasatkin wrote:
>
> > Digitally signed initramfs can be used to provide protected user-space
> > environment for initialization purpose. For example, LSM, IMA/EVM can be
> > securely initialized using such approach.
>
> What stops an attacker from simply removing the signed image from the
> initramfs and running modified versions of the same tools from the
> unsigned image?

I'm sorry, ignore that - if the kernel's configured to do this, it'll
panic if it can't find the signed image. Ok.

--
Matthew Garrett | mjg59@srcf.ucam.org


\
 
 \ /
  Last update: 2013-02-05 20:42    [W:0.138 / U:9.972 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site