[Starlingx-discuss] IMA signatures (was: how to deal with loop dependent in building stage)

Scott Little scott.little at windriver.com
Wed Dec 1 20:37:40 UTC 2021


Thanks for the link.   Good read.

Scott


On 2021-12-01 2:53 p.m., Jeremy Stanley wrote:
> [Please note: This e-mail is from an EXTERNAL e-mail address]
>
> On 2021-09-23 16:11:25 +0000 (+0000), Jeremy Stanley wrote:
> [...]
>> Anyway, this looks like a relevant feature request for it along with
>> a proof of concept implementation (albeit with 7 years of cobwebs):
>>
>>      https://bugs.debian.org/766267
>>      https://lists.debian.org/debian-dpkg/2014/08/threads.html#00006
>>
>> The implementation looks fairly straightforward, the file signatures
>> would be generated when the packages are assembled and stored with
>> the file checksums normally tracked, then at installation those
>> signatures would be copied into extended filesystem attributes for
>> the relevant files, to be consumed by the kernel.
>>
>> If this is of interest to the StarlingX community, it might be an
>> activity worth reigniting in Debian. It looks like the developers at
>> IBM who originally proposed support for it did not pursue it
>> further, at least that I can find any record of.
> A thread on the oss-security mailing list this week reminded me of
> the earlier discussion here. Interestingly, it's a developer at Red
> Hat questioning the (f)utility of IMA signatures on files:
>
>      https://www.openwall.com/lists/oss-security/2021/11/30/1
>
> --
> Jeremy Stanley
>
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20211201/c4594de1/attachment-0001.htm>


More information about the Starlingx-discuss mailing list