Thanks for the link. Good read. Scott On 2021-12-01 2:53 p.m., Jeremy Stanley wrote:
[Please note: This e-mail is from an EXTERNAL e-mail address]
Anyway, this looks like a relevant feature request for it along with a proof of concept implementation (albeit with 7 years of cobwebs):
https://bugs.debian.org/766267 https://lists.debian.org/debian-dpkg/2014/08/threads.html#00006
The implementation looks fairly straightforward, the file signatures would be generated when the packages are assembled and stored with the file checksums normally tracked, then at installation those signatures would be copied into extended filesystem attributes for the relevant files, to be consumed by the kernel.
If this is of interest to the StarlingX community, it might be an activity worth reigniting in Debian. It looks like the developers at IBM who originally proposed support for it did not pursue it further, at least that I can find any record of. A thread on the oss-security mailing list this week reminded me of
On 2021-09-23 16:11:25 +0000 (+0000), Jeremy Stanley wrote: [...] the earlier discussion here. Interestingly, it's a developer at Red Hat questioning the (f)utility of IMA signatures on files:
https://www.openwall.com/lists/oss-security/2021/11/30/1
-- Jeremy Stanley
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss