<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
  </head>
  <body>
    <div class="moz-cite-prefix">Thanks for the link.   Good read.<br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">Scott</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">On 2021-12-01 2:53 p.m., Jeremy Stanley
      wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:20211201195340.36zpqt2u5evtw6jg@yuggoth.org">
      <pre class="moz-quote-pre" wrap="">[Please note: This e-mail is from an EXTERNAL e-mail address]

On 2021-09-23 16:11:25 +0000 (+0000), Jeremy Stanley wrote:
[...]
</pre>
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">Anyway, this looks like a relevant feature request for it along with
a proof of concept implementation (albeit with 7 years of cobwebs):

    <a class="moz-txt-link-freetext" href="https://bugs.debian.org/766267">https://bugs.debian.org/766267</a>
    <a class="moz-txt-link-freetext" href="https://lists.debian.org/debian-dpkg/2014/08/threads.html#00006">https://lists.debian.org/debian-dpkg/2014/08/threads.html#00006</a>

The implementation looks fairly straightforward, the file signatures
would be generated when the packages are assembled and stored with
the file checksums normally tracked, then at installation those
signatures would be copied into extended filesystem attributes for
the relevant files, to be consumed by the kernel.

If this is of interest to the StarlingX community, it might be an
activity worth reigniting in Debian. It looks like the developers at
IBM who originally proposed support for it did not pursue it
further, at least that I can find any record of.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">
A thread on the oss-security mailing list this week reminded me of
the earlier discussion here. Interestingly, it's a developer at Red
Hat questioning the (f)utility of IMA signatures on files:

    <a class="moz-txt-link-freetext" href="https://www.openwall.com/lists/oss-security/2021/11/30/1">https://www.openwall.com/lists/oss-security/2021/11/30/1</a>

--
Jeremy Stanley
</pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <pre class="moz-quote-pre" wrap="">_______________________________________________
Starlingx-discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Starlingx-discuss@lists.starlingx.io">Starlingx-discuss@lists.starlingx.io</a>
<a class="moz-txt-link-freetext" href="http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss">http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss</a>
</pre>
    </blockquote>
    <p><br>
    </p>
  </body>
</html>