On Mon, 2013-01-28 at 13:56 -0500, Vivek Goyal wrote: > On Mon, Jan 28, 2013 at 05:20:20PM +0200, Kasatkin, Dmitry wrote: > > [..] > > > Ok. I am hoping that it will be more than the kernel command line we > > > support. In the sense that for digital signatures one needs to parse > > > the signature, look at what hash algorithm has been used and then > > > collect the hash accordingly. It is little different then IMA requirement > > > of calculating one pre-determine hash for all files. > > > > Yes... It is obvious. It's coming. > > But in general, signer should be aware of requirements and limitation > > of the platform. > > It is not really a problem... > > One more question. I specified "ima_appraise_tcb" on kernel command line > and I had an unbootable system. It refused to run "init" as it was not > labeled/signed. Is there any policy/way where it appraises only signed > files and does not refuse to open/execute unsigned ones. The policy defines what needs to be measured/appraised, not the other way around. There's nothing preventing you from defining and loading a different policy, one to your liking, before pivoting root. thanks, Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
