lkml.org 
[lkml]   [2017]   [Nov]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Firmware signing -- Re: [PATCH 00/27] security, efi: Add kernel lockdown
From
Date

> > Or reflect that IMA-appraisal, if enabled, will enforce firmware being
> > validly signed.
>
> But FWICT lockdown is a built-in kernel thingy, unless lockdown implies IMA
> it would not be the place to refer to it.
>
> It seems the documentation was proposed to help users if an error was caught.
> That error should cover only what is being addressed in code on the kernel.

Enabling "lockdown" needs to take into account IMA-appraisal to
prevent breaking systems with it enabled.

An IMA builtin "secure_boot" policy was already upstreamed (commit
503ceaef8e2e "ima: define a set of appraisal rules requiring file
signatures").  An additional patch, automatically enables the
"secure_boot" policy in "lockdown" mode.

Refer to this discussion and patch:
http://kernsec.org/pipermail/linux-security-module-archive/2017-October/003913.html
http://kernsec.org/pipermail/linux-security-module-archive/2017-October/003910.html

thanks,

Mimi

\
 
 \ /
  Last update: 2017-11-08 21:15    [W:0.137 / U:5.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site