Re: [Ksummit-discuss] Last minute nominations: mcgrof and toshi

[Mimi Zohar <zohar@linux.vnet.ibm.com>]

On So, 2016-07-31 at 11:20 -0700, Andy Lutomirski wrote:
> On Jul 31, 2016 10:29 AM, "Mimi Zohar" <zohar@linux.vnet.ibm.com> wrote:

> > > Also, are there any plans to move module signature verification into
> > > .kernel_post_read_file?
> >
> > The whole point of defining the kernel_read_file() family of functions
> > was to close a class of measurement/appraisal gaps.
> 
> And to enable firmware verification?

Yes, including firmware signature verification.

> >   To answer your
> > question, yes IMA measures and/or appraises files on the security post
> > kernel read hook, based on policy.
> 
> I wasn't asking anything about IMA.

>From my understanding of your question, you're asking if there is an LSM
that uses this hook for verifying firmware signatures.  IMA uses the LSM
hooks and defines a few additional hooks to enforce file integrity.
For all practical purposes it is an LSM+.

> > Andy, other than IMA-appraisal being xattr based,  I'm not sure why
> > you're so against it.   if you're going to be at LinuxCon/LSS, perhaps
> > we could speak in person there.
> 
> I have nothing against IMA.  I have plenty of objection to the core hooks
> being simultaneously messy and not supplying enough information to provide
> the security properties they should provide.

The discussions took place on the kexec, firmware, kernel modules and
LSM mailing lists late last year and earlier this year.  You could have
commented on the patches and raised your concerns then, but it isn't too
late at this point.  These are internal functions, not an external API
that can not be modified.

Though, before making any changes we should address Luis' question,
"Path seems like the next target?  Anything else ?"

Mimi