From: James Morris <jmorris@namei.org>
To: Thiago Jung Bauermann <bauerman@linux.ibm.com>
Cc: linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org, keyrings@vger.kernel.org,
linux-crypto@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
Mimi Zohar <zohar@linux.ibm.com>,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
"Serge E. Hallyn" <serge@hallyn.com>,
David Howells <dhowells@redhat.com>,
David Woodhouse <dwmw2@infradead.org>,
Jessica Yu <jeyu@kernel.org>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Jonathan Corbet <corbet@lwn.net>,
"AKASHI, Takahiro" <takahiro.akashi@linaro.org>
Subject: Re: [PATCH v8 00/14] Appended signatures support for IMA appraisal
Date: Wed, 5 Dec 2018 08:59:45 +1100 (AEDT) [thread overview]
Message-ID: <alpine.LRH.2.21.1812050855270.22148@namei.org> (raw)
In-Reply-To: <20181116200712.14154-1-bauerman@linux.ibm.com>
On Fri, 16 Nov 2018, Thiago Jung Bauermann wrote:
> On the OpenPOWER platform, secure boot and trusted boot are being
> implemented using IMA for taking measurements and verifying signatures.
> Since the kernel image on Power servers is an ELF binary, kernels are
> signed using the scripts/sign-file tool and thus use the same signature
> format as signed kernel modules.
>
> This patch series adds support in IMA for verifying those signatures.
Are you saying you use IMA to verify kernels during boot? From a Linux
bootloader?
> It adds flexibility to OpenPOWER secure boot, because it allows it to boot
> kernels with the signature appended to them as well as kernels where the
> signature is stored in the IMA extended attribute.
Just to clarify, with these patches, IMA will be able to verify the
native form of signed kernel modules? i.e. without xattrs at all, and
this will work with existing signed modules?
--
James Morris
<jmorris@namei.org>
WARNING: multiple messages have this Message-ID (diff)
From: James Morris <jmorris@namei.org>
To: Thiago Jung Bauermann <bauerman@linux.ibm.com>
Cc: linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org, keyrings@vger.kernel.org,
linux-crypto@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
Mimi Zohar <zohar@linux.ibm.com>,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
"Serge E. Hallyn" <serge@hallyn.com>,
David Howells <dhowells@redhat.com>,
David Woodhouse <dwmw2@infradead.org>,
Jessica Yu <jeyu@kernel.org>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Jonathan Corbet <corbet@lwn.net>,
"AKASHI, Takahiro" <takahiro.akashi@linaro.org>
Subject: Re: [PATCH v8 00/14] Appended signatures support for IMA appraisal
Date: Tue, 04 Dec 2018 21:59:45 +0000 [thread overview]
Message-ID: <alpine.LRH.2.21.1812050855270.22148@namei.org> (raw)
In-Reply-To: <20181116200712.14154-1-bauerman@linux.ibm.com>
On Fri, 16 Nov 2018, Thiago Jung Bauermann wrote:
> On the OpenPOWER platform, secure boot and trusted boot are being
> implemented using IMA for taking measurements and verifying signatures.
> Since the kernel image on Power servers is an ELF binary, kernels are
> signed using the scripts/sign-file tool and thus use the same signature
> format as signed kernel modules.
>
> This patch series adds support in IMA for verifying those signatures.
Are you saying you use IMA to verify kernels during boot? From a Linux
bootloader?
> It adds flexibility to OpenPOWER secure boot, because it allows it to boot
> kernels with the signature appended to them as well as kernels where the
> signature is stored in the IMA extended attribute.
Just to clarify, with these patches, IMA will be able to verify the
native form of signed kernel modules? i.e. without xattrs at all, and
this will work with existing signed modules?
--
James Morris
<jmorris@namei.org>
WARNING: multiple messages have this Message-ID (diff)
From: James Morris <jmorris@namei.org>
To: Thiago Jung Bauermann <bauerman@linux.ibm.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
linux-doc@vger.kernel.org,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
Jonathan Corbet <corbet@lwn.net>,
linux-kernel@vger.kernel.org, Mimi Zohar <zohar@linux.ibm.com>,
"David S. Miller" <davem@davemloft.net>,
David Howells <dhowells@redhat.com>,
"AKASHI, Takahiro" <takahiro.akashi@linaro.org>,
linux-security-module@vger.kernel.org, keyrings@vger.kernel.org,
linux-crypto@vger.kernel.org, Jessica Yu <jeyu@kernel.org>,
linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
David Woodhouse <dwmw2@infradead.org>,
"Serge E. Hallyn" <serge@hallyn.com>
Subject: Re: [PATCH v8 00/14] Appended signatures support for IMA appraisal
Date: Wed, 5 Dec 2018 08:59:45 +1100 (AEDT) [thread overview]
Message-ID: <alpine.LRH.2.21.1812050855270.22148@namei.org> (raw)
In-Reply-To: <20181116200712.14154-1-bauerman@linux.ibm.com>
On Fri, 16 Nov 2018, Thiago Jung Bauermann wrote:
> On the OpenPOWER platform, secure boot and trusted boot are being
> implemented using IMA for taking measurements and verifying signatures.
> Since the kernel image on Power servers is an ELF binary, kernels are
> signed using the scripts/sign-file tool and thus use the same signature
> format as signed kernel modules.
>
> This patch series adds support in IMA for verifying those signatures.
Are you saying you use IMA to verify kernels during boot? From a Linux
bootloader?
> It adds flexibility to OpenPOWER secure boot, because it allows it to boot
> kernels with the signature appended to them as well as kernels where the
> signature is stored in the IMA extended attribute.
Just to clarify, with these patches, IMA will be able to verify the
native form of signed kernel modules? i.e. without xattrs at all, and
this will work with existing signed modules?
--
James Morris
<jmorris@namei.org>
next prev parent reply other threads:[~2018-12-04 22:00 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-16 20:06 [PATCH v8 00/14] Appended signatures support for IMA appraisal Thiago Jung Bauermann
2018-11-16 20:06 ` Thiago Jung Bauermann
2018-11-16 20:06 ` Thiago Jung Bauermann
2018-11-16 20:06 ` [PATCH v8 01/14] MODSIGN: Export module signature definitions Thiago Jung Bauermann
2018-11-16 20:06 ` Thiago Jung Bauermann
2018-11-16 20:06 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 02/14] PKCS#7: Refactor verify_pkcs7_signature() and add pkcs7_get_message_sig() Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 03/14] PKCS#7: Introduce pkcs7_get_digest() Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 04/14] integrity: Introduce struct evm_xattr Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-29 20:59 ` Mimi Zohar
2018-11-29 20:59 ` Mimi Zohar
2018-11-29 20:59 ` Mimi Zohar
2018-11-16 20:07 ` [PATCH v8 05/14] integrity: Introduce integrity_keyring_from_id() Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 06/14] integrity: Introduce asymmetric_sig_has_known_key() Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 07/14] integrity: Select CONFIG_KEYS instead of depending on it Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 08/14] ima: Introduce is_signed() Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 09/14] ima: Export func_tokens Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 10/14] ima: Add modsig appraise_type option for module-style appended signatures Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 11/14] ima: Implement support " Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 12/14] ima: Add new "d-sig" template field Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 13/14] ima: Write modsig to the measurement list Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` [PATCH v8 14/14] ima: Store the measurement again when appraising a modsig Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-11-16 20:07 ` Thiago Jung Bauermann
2018-12-04 21:59 ` James Morris [this message]
2018-12-04 21:59 ` [PATCH v8 00/14] Appended signatures support for IMA appraisal James Morris
2018-12-04 21:59 ` James Morris
2018-12-04 23:35 ` Thiago Jung Bauermann
2018-12-04 23:35 ` Thiago Jung Bauermann
2018-12-04 23:35 ` Thiago Jung Bauermann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LRH.2.21.1812050855270.22148@namei.org \
--to=jmorris@namei.org \
--cc=bauerman@linux.ibm.com \
--cc=corbet@lwn.net \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=dwmw2@infradead.org \
--cc=herbert@gondor.apana.org.au \
--cc=jeyu@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=serge@hallyn.com \
--cc=takahiro.akashi@linaro.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.