Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3]

From	Mimi Zohar <zohar@linux.vnet.ibm.com>
Newsgroups	linux.kernel
Subject	Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3]
Date	2016-04-01 19:10 +0200
Message-ID	<rjaK5-7AB-7@gated-at.bofh.it> (permalink)
References	(2 earlier) <rhDZT-6xZ-7@gated-at.bofh.it> <raKjM-77j-5@gated-at.bofh.it> <raKtu-7bN-47@gated-at.bofh.it> <rirak-82U-47@gated-at.bofh.it> <rj7VT-5vb-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, 2016-04-01 at 15:06 +0100, David Howells wrote:
> David Howells <dhowells@redhat.com> wrote:
> 
> > The three choice options I implemented don't exactly provide new features.
> > Firstly:
> > 
> > 	config IMA_LOAD_X509
> > 
> > allow keys to be loaded in at compile time,
> 
> Ah - I think I'm labouring under a slight misapprehension here.  IMA_LOAD_X509
> doesn't load keys at compile time, but rather the kernel loads a file by name
> when booting, right?

Right, all certificates must be signed by a key on the builtin (or
secondary keyring) before being added to the IMA keyring.   Similarly,
dracut (modules/98integrity/ and systemd (ima-setup.c) have support for
loading signed certificates on the IMA keyring.

Mimi

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings  instead of .ima_mok [ver #3] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-03-28 14:00 +0200
  Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3] David Howells <dhowells@redhat.com> - 2016-03-30 18:30 +0200
    Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings  instead of .ima_mok [ver #3] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-03-31 14:30 +0200
      Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3] David Howells <dhowells@redhat.com> - 2016-03-31 17:20 +0200
        Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings  instead of .ima_mok [ver #3] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-03-31 18:00 +0200
          Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings  instead of .ima_mok [ver #3] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-04-01 00:20 +0200
            Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3] David Howells <dhowells@redhat.com> - 2016-04-01 16:40 +0200
              Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings  instead of .ima_mok [ver #3] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-04-01 19:00 +0200
        Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3] David Howells <dhowells@redhat.com> - 2016-04-01 16:10 +0200
          Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings  instead of .ima_mok [ver #3] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-04-01 19:10 +0200

csiph-web