lkml.org 
[lkml]   [2013]   [Sep]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 00/12] One more attempt at useful kernel lockdown
From
Date
On Tue, 2013-09-10 at 16:48 -0700, H. Peter Anvin wrote:
> On 09/10/2013 04:43 PM, Mimi Zohar wrote:
> >
> > Why invent yet another method of verifying the integrity of a file based
> > on a signature? Why not use the existing method for appraising files?
> > Just create a new integrity hook at the appropriate place.
> >
>
> What would the deliverables be from the hardware vendor and what tools
> would you expect them to need on their end?

The package installer needs to not only install files, but file metadata
as well. Elena Reshetova (Intel) has already added rpm hooks to write
security xattrs. The next step, yet to be done, is to include and write
the signatures as part of the rpm install process.

Mimi



\
 
 \ /
  Last update: 2013-09-11 02:21    [W:0.141 / U:0.272 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site