Re: [PATCH v3 7/7] ima: Support module-style appended signatures for appraisal

2017-08-03 Thread Thiago Jung Bauermann
Mimi Zohar writes: > On Wed, 2017-08-02 at 18:52 -0400, Mimi Zohar wrote: >> On Wed, 2017-08-02 at 14:42 -0300, Thiago Jung Bauermann wrote: >> > Mimi Zohar writes: > >> > >> @@ -229,8 +251,24 @@ int ima_appraise_measurement(enum ima_hooks

Re: [PATCH v3 7/7] ima: Support module-style appended signatures for appraisal

2017-08-03 Thread Mimi Zohar
On Wed, 2017-08-02 at 18:52 -0400, Mimi Zohar wrote: > On Wed, 2017-08-02 at 14:42 -0300, Thiago Jung Bauermann wrote: > > Mimi Zohar writes: > > >> @@ -229,8 +251,24 @@ int ima_appraise_measurement(enum ima_hooks func, > > >> goto out; > > >>

Re: [PATCH v3 7/7] ima: Support module-style appended signatures for appraisal

2017-08-02 Thread Mimi Zohar
On Wed, 2017-08-02 at 14:42 -0300, Thiago Jung Bauermann wrote: > Mimi Zohar writes: > > > On Thu, 2017-07-06 at 19:17 -0300, Thiago Jung Bauermann wrote: > >> --- a/security/integrity/ima/ima_appraise.c > >> +++ b/security/integrity/ima/ima_appraise.c > >> @@ -200,18

Re: [PATCH v3 7/7] ima: Support module-style appended signatures for appraisal

2017-08-02 Thread Thiago Jung Bauermann
Mimi Zohar writes: > On Thu, 2017-07-06 at 19:17 -0300, Thiago Jung Bauermann wrote: >> --- a/security/integrity/ima/ima_appraise.c >> +++ b/security/integrity/ima/ima_appraise.c >> @@ -200,18 +200,40 @@ int ima_read_xattr(struct dentry *dentry, >> */ >> int

Re: [PATCH v3 7/7] ima: Support module-style appended signatures for appraisal

2017-07-30 Thread Mimi Zohar
On Thu, 2017-07-06 at 19:17 -0300, Thiago Jung Bauermann wrote: > This patch introduces the modsig keyword to the IMA policy syntax to > specify that a given hook should expect the file to have the IMA signature > appended to it. Here is how it can be used in a rule: > > appraise

[PATCH v3 7/7] ima: Support module-style appended signatures for appraisal

2017-07-06 Thread Thiago Jung Bauermann
This patch introduces the modsig keyword to the IMA policy syntax to specify that a given hook should expect the file to have the IMA signature appended to it. Here is how it can be used in a rule: appraise func=KEXEC_KERNEL_CHECK appraise_type=modsig|imasig With this rule, IMA will accept