Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-20 Thread Serge E. Hallyn
Quoting Mimi Zohar (zo...@linux.vnet.ibm.com): > On Mon, 2017-11-20 at 10:40 +0100, Roberto Sassu wrote: > > On 11/19/2017 12:23 AM, Mimi Zohar wrote: > > > Hi Serge, > > > > > > On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: > > >> On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-20 Thread Serge E. Hallyn
Quoting Mimi Zohar (zo...@linux.vnet.ibm.com): > On Mon, 2017-11-20 at 10:40 +0100, Roberto Sassu wrote: > > On 11/19/2017 12:23 AM, Mimi Zohar wrote: > > > Hi Serge, > > > > > > On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: > > >> On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-20 Thread Mimi Zohar
On Mon, 2017-11-20 at 10:40 +0100, Roberto Sassu wrote: > On 11/19/2017 12:23 AM, Mimi Zohar wrote: > > Hi Serge, > > > > On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: > >> On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: > >>> from a predefined position

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-20 Thread Mimi Zohar
On Mon, 2017-11-20 at 10:40 +0100, Roberto Sassu wrote: > On 11/19/2017 12:23 AM, Mimi Zohar wrote: > > Hi Serge, > > > > On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: > >> On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: > >>> from a predefined position

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-20 Thread Roberto Sassu
On 11/19/2017 12:23 AM, Mimi Zohar wrote: Hi Serge, On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: from a predefined position (/etc/ima/digest_lists/metadata), when rootfs becomes available. Digest lists must be loaded

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-20 Thread Roberto Sassu
On 11/19/2017 12:23 AM, Mimi Zohar wrote: Hi Serge, On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: from a predefined position (/etc/ima/digest_lists/metadata), when rootfs becomes available. Digest lists must be loaded

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-18 Thread Mimi Zohar
Hi Serge, On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: > On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: > > from a predefined position (/etc/ima/digest_lists/metadata), when rootfs > > becomes available. Digest lists must be loaded before IMA appraisal is in > >

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-18 Thread Mimi Zohar
Hi Serge, On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote: > On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: > > from a predefined position (/etc/ima/digest_lists/metadata), when rootfs > > becomes available. Digest lists must be loaded before IMA appraisal is in > >

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-17 Thread Serge E. Hallyn
On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: > from a predefined position (/etc/ima/digest_lists/metadata), when rootfs > becomes available. Digest lists must be loaded before IMA appraisal is in > enforcing mode. I'm sure there's a good reason for it, but this seems weird to

Re: [PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-17 Thread Serge E. Hallyn
On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote: > from a predefined position (/etc/ima/digest_lists/metadata), when rootfs > becomes available. Digest lists must be loaded before IMA appraisal is in > enforcing mode. I'm sure there's a good reason for it, but this seems weird to

[PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-07 Thread Roberto Sassu
Digest lists can be uploaded to IMA by supplying the path of their metadata. Digest list metadata are: - DATA_ALGO: algorithm of the digests to be uploaded - DATA_DIGEST: digest of the file containing the digest list - DATA_SIGNATURE: signature of the file containing the digest list -

[PATCH v2 06/15] ima: add parser of digest lists metadata

2017-11-07 Thread Roberto Sassu
Digest lists can be uploaded to IMA by supplying the path of their metadata. Digest list metadata are: - DATA_ALGO: algorithm of the digests to be uploaded - DATA_DIGEST: digest of the file containing the digest list - DATA_SIGNATURE: signature of the file containing the digest list -