[lkml]   [2019]   [May]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: SGX vs LSM (Re: [PATCH v20 00/28] Intel SGX1 support)
On Wed, 15 May 2019, Andy Lutomirski wrote:

> > Why not just use an xattr, like security.sgx ?
> Wouldn't this make it so that only someone with CAP_MAC_ADMIN could
> install an enclave? I think that this decision should be left up the
> administrator, and it should be easy to set up a loose policy where
> anyone can load whatever enclave they want. That's what would happen
> in my proposal if there was no LSM loaded or of the LSM policy didn't
> restrict what .sigstruct files were acceptable.

You could try user.sigstruct, which does not require any privs.

James Morris

 \ /
  Last update: 2019-05-16 00:47    [W:0.102 / U:6.656 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site