From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: Mimi Zohar <zohar@linux.ibm.com>, linux-integrity@vger.kernel.org
Cc: eric.snowberg@oracle.com, dhowells@redhat.com,
matthewgarrett@google.com, sashal@kernel.org,
jamorris@linux.microsoft.com, linux-kernel@vger.kernel.org,
keyrings@vger.kernel.org
Subject: Re: [PATCH v9 5/6] IMA: Add support to limit measuring keys
Date: Tue, 3 Dec 2019 08:13:48 -0800 [thread overview]
Message-ID: <e2faf0d0-fee1-96fe-1120-c003761aa517@linux.microsoft.com> (raw)
In-Reply-To: <1575375945.5241.16.camel@linux.ibm.com>
On 12/3/2019 4:25 AM, Mimi Zohar wrote:
Hi Mimi,
> Hi Lakshmi,
>
> A keyring can be created by any user with any keyring name, other than
> ones dot prefixed, which are limited to the trusted builtin keyrings.
> With a policy of "func=KEY_CHECK template=ima-buf keyrings=foo", for
> example, keys loaded onto any keyring named "foo" will be measured.
> For files, the IMA policy may be constrained to a particular uid/gid.
> An additional method of identifying or constraining keyring names
> needs to be defined.
>
I agree - this is a good idea.
Do you think this can be added as a separate patch set - enhancement to
the current one, or should this be addressed in the current set?
I was just about to send an update today that addresses your latest
comments. Will hold it if you think the above change should be included
now. Please let me know.
thanks,
-lakshmi
next prev parent reply other threads:[~2019-12-03 16:13 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-27 1:56 [PATCH v9 0/6] KEYS: Measure keys when they are created or updated Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 1/6] IMA: Check IMA policy flag Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 2/6] IMA: Add KEY_CHECK func to measure keys Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 3/6] IMA: Define an IMA hook " Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 4/6] KEYS: Call the " Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 5/6] IMA: Add support to limit measuring keys Lakshmi Ramasubramanian
2019-11-27 18:52 ` Mimi Zohar
2019-11-28 0:44 ` Lakshmi Ramasubramanian
2019-12-02 18:18 ` Mimi Zohar
2019-12-03 12:25 ` Mimi Zohar
2019-12-03 16:13 ` Lakshmi Ramasubramanian [this message]
2019-12-03 16:47 ` Mimi Zohar
2019-12-03 19:45 ` Lakshmi Ramasubramanian
2019-12-03 20:06 ` Mimi Zohar
2019-12-03 23:37 ` Lakshmi Ramasubramanian
2019-12-04 11:16 ` Mimi Zohar
2019-12-04 22:43 ` Lakshmi Ramasubramanian
2019-12-04 23:25 ` Mat Martineau
2019-11-27 1:56 ` [PATCH v9 6/6] IMA: Read keyrings= option from the IMA policy Lakshmi Ramasubramanian
2019-11-27 19:32 ` Mimi Zohar
2019-11-27 22:05 ` Lakshmi Ramasubramanian
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e2faf0d0-fee1-96fe-1120-c003761aa517@linux.microsoft.com \
--to=nramas@linux.microsoft.com \
--cc=dhowells@redhat.com \
--cc=eric.snowberg@oracle.com \
--cc=jamorris@linux.microsoft.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=matthewgarrett@google.com \
--cc=sashal@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).