On Thu, 2017-10-19 at 11:02 +0000, Dmitry Kasatkin wrote: > BTW. > > Just to refresh my mind. What would be the correct order for setting > this signature from package? > On any attr/xattr change, EVM will set HMAC. The system is running without an EVM symmetric key, just an asymmetric key. > What is the value of setting signature after that unless there is a > policy to require signature (immutable)? > In my original patchset portable was also immutable and also > included policy support to require EVM signatures. In Matthew's usecase scenario, only immutable and portable signatures exist. The EVM verification for unsigned files will be INTEGRITY_UNKNOWN. Mimi
