On Tue, 2013-01-29 at 13:20 -0500, Vivek Goyal wrote: > On Mon, Jan 28, 2013 at 08:48:55PM -0500, Mimi Zohar wrote: > > [..] > > > Hi Mimi, > > > > > > By policy you mean ima rules here? So I can either enable default rules > > > (tcb default rules for appraisal and measurement) by using kernel command > > > line options or dynamically configure my own rules using /sysfs interface? > > > > > > If yes, AFAIK, existing inputtable policies do not allow this selective > > > mode where we do appraisal only on signed executable. That means I shall > > > have to extend the way policies can be specified so that one specify > > > that appraise only signed files? > > > > We've just added the ability of defining the method for appraising a > > file and defining rules in terms of the filesystem UUID. Extending the > > IMA policy shouldn't be a problem, but I'm not sure how you would go > > about adding support for only appraising files with digital signatures. > > Hi Mimi, > > Can we add another field to ima_rule_entry, say .enforcement to control > the behavior of .action. Possible values of .enforcement could be, say. > > ALL > SIGNED_ONLY > > ALL will be default. And with .action= MEASURE, one could possibly use > .enforcement=SIGNED_ONLY. Other than the .action being '.action=APPRAISE', not 'MEASURE', something like what you're suggesting, could work. How about extending the new 'appraise_type=' option? The appraise_type enforces a particular type (eg. hash, signature) of verification. option: appraise_type:= [imasig[,signed_only]] eg. appraise_type=imasig,signed_only thanks, Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
