[lkml]   [2014]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [Linux-ima-user] Initramfs and IMA Appraisal
On Mon, 29 Dec 2014, Mimi Zohar wrote:

> Thanks Rob for the explanation. The problem is that ramfs does not
> support extended attributes, while tmpfs does. The boot loader could
> "measure" (trusted boot) the initramfs, but as the initramfs is
> generated on the target system, the initramfs is not signed, preventing
> it from being appraised (secure Boot). To close the initramfs integrity
> appraisal gap requires verifying the individual initramfs file
> signatures, which are stored as extended attributes.

what's the point of checking the files on the filesystem against signatures
stored on the same filesystem? If someone could alter the file contents they can
alter the signatures as well.

David Lang

 \ /
  Last update: 2014-12-30 04:01    [W:0.042 / U:0.628 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site