On Thu, 2023-10-05 at 12:32 +0200, Mickaël Salaün wrote: > > > > A complementary approach would be to create an > > > > LSM (or a dedicated interface) to tie certificate properties to a set of > > > > kernel usages, while still letting users configure these constraints. > > > > > > That is an interesting idea. Would the other security maintainers be in > > > support of such an approach? Would a LSM be the correct interface? > > > Some of the recent work I have done with introducing key usage and CA > > > enforcement is difficult for a distro to pick up, since these changes can be > > > viewed as a regression. Each end-user has different signing procedures > > > and policies, so making something work for everyone is difficult. Letting the > > > user configure these constraints would solve this problem. Something definitely needs to be done about controlling the usage of x509 certificates. My concern is the level of granularity. Would this be at the LSM hook level or even finer granaularity? -- thanks, Mimi
