Thanks for the link.   Good read.

Scott


On 2021-12-01 2:53 p.m., Jeremy Stanley wrote:
[Please note: This e-mail is from an EXTERNAL e-mail address]

On 2021-09-23 16:11:25 +0000 (+0000), Jeremy Stanley wrote:
[...]
Anyway, this looks like a relevant feature request for it along with
a proof of concept implementation (albeit with 7 years of cobwebs):

    https://bugs.debian.org/766267
    https://lists.debian.org/debian-dpkg/2014/08/threads.html#00006

The implementation looks fairly straightforward, the file signatures
would be generated when the packages are assembled and stored with
the file checksums normally tracked, then at installation those
signatures would be copied into extended filesystem attributes for
the relevant files, to be consumed by the kernel.

If this is of interest to the StarlingX community, it might be an
activity worth reigniting in Debian. It looks like the developers at
IBM who originally proposed support for it did not pursue it
further, at least that I can find any record of.
A thread on the oss-security mailing list this week reminded me of
the earlier discussion here. Interestingly, it's a developer at Red
Hat questioning the (f)utility of IMA signatures on files:

    https://www.openwall.com/lists/oss-security/2021/11/30/1

--
Jeremy Stanley

_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss@lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss