[Starlingx-discuss] IMA signatures (was: how to deal with loop dependent in building stage)
fungi at yuggoth.org
Wed Dec 1 19:53:40 UTC 2021
On 2021-09-23 16:11:25 +0000 (+0000), Jeremy Stanley wrote:
> Anyway, this looks like a relevant feature request for it along with
> a proof of concept implementation (albeit with 7 years of cobwebs):
> The implementation looks fairly straightforward, the file signatures
> would be generated when the packages are assembled and stored with
> the file checksums normally tracked, then at installation those
> signatures would be copied into extended filesystem attributes for
> the relevant files, to be consumed by the kernel.
> If this is of interest to the StarlingX community, it might be an
> activity worth reigniting in Debian. It looks like the developers at
> IBM who originally proposed support for it did not pursue it
> further, at least that I can find any record of.
A thread on the oss-security mailing list this week reminded me of
the earlier discussion here. Interestingly, it's a developer at Red
Hat questioning the (f)utility of IMA signatures on files:
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 963 bytes
Desc: not available
More information about the Starlingx-discuss