On Mon, Nov 13, 2017 at 03:11:12PM -0500, Mimi Zohar wrote: > On Mon, 2017-11-13 at 20:51 +0100, Luis R. Rodriguez wrote: > > On Mon, Nov 13, 2017 at 02:36:47PM -0500, Mimi Zohar wrote: > > > > Huh, I kind of lost you here. What does "it" refer to in the above > > > sentence? IMA is in the kernel. So, who does what checks in > > > userspace? > > > > Sorry I thought some checks were done in userspace, given that is clarified, > > what I meant is that say a device driver has a signing specification written > > out in the driver, should/can IMA use that on the LSM to verify the detached > > signature file for the firmware? > > IMA-appraisal currently supports file signatures as extended > attributes. Thiago Bauermann posted patches for including appended > signature support to IMA-appraisal. If someone is interested in > adding detached signature support, they're welcome to do so. Neat. > > If it can be all done in kernel, it has me wondering if perhaps one option for > > IMA might be to do only vetting for these types of checks, where the info and > > description to appraise files is all in-kernel. IMA would not be required > > for other files. > > We probably can defer this discussion until it is applicable. Fair enough :) Luis
