On Mon, 2017-11-13 at 20:51 +0100, Luis R. Rodriguez wrote: > On Mon, Nov 13, 2017 at 02:36:47PM -0500, Mimi Zohar wrote: > > Huh, I kind of lost you here. What does "it" refer to in the above > > sentence? IMA is in the kernel. So, who does what checks in > > userspace? > > Sorry I thought some checks were done in userspace, given that is clarified, > what I meant is that say a device driver has a signing specification written > out in the driver, should/can IMA use that on the LSM to verify the detached > signature file for the firmware? IMA-appraisal currently supports file signatures as extended attributes. Thiago Bauermann posted patches for including appended signature support to IMA-appraisal. If someone is interested in adding detached signature support, they're welcome to do so. > If it can be all done in kernel, it has me wondering if perhaps one option for > IMA might be to do only vetting for these types of checks, where the info and > description to appraise files is all in-kernel. IMA would not be required > for other files. We probably can defer this discussion until it is applicable. Mimi
