On Fri, Aug 28, 2015 at 06:26:05PM -0400, Paul Moore wrote: > On Fri, Aug 28, 2015 at 7:20 AM, Roberts, William C > <william.c.roberts@xxxxxxxxx> wrote: > > Even triggered updates make sense, since you can at least have some form of trust > > of where that binary policy came from. > > It isn't always that simple, see my earlier comments about > customization and manipulation by the policy loading tools. If the customization of the data is done in kernel then the kernel can *first* verify the file's signature prior to doing any data modification. If userspace does the modification then the signature stuff won't work unless the tool will have access to the MOK and can sign it pre-flight to the kernel selinuxfs. > > Huh, not following? Perhaps, I am not following what your laying down here. > > > > Right now there is no signing on the selinux policy file. We should be able > > to just use the firmware signing api's as is (I have not looked on linux-next yet) > > to unpack the blob. > > I haven't looked at the existing fw signing hook in any detail to be > able to comment on its use as a policy verification hook. As long as > we preserve backwards compatibility and don't introduce a new > mechanism/API for loading SELinux policy I doubt I would have any > objections. You'd just have to implement a permissive model as we are with the fw signing. No radical customizations, except one thing to note is that on the fw signing side of things we're going to have the signature of the file *detached* in separate file. I think what you're alluding to is the issue of where that signature would be stuff in the SELinux policy file and its correct that you'd need to address that. You could just borrow the kernel's model and reader / sucker that strips out the signature. Another possibility would be two files but then I guess you'd need a trigger to annotate both are in place. Luis -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
