[Starlingx-discuss] IMA signatures (was: how to deal with loop dependent in building stage)

Jeremy Stanley fungi at yuggoth.org
Wed Dec 1 19:53:40 UTC 2021


On 2021-09-23 16:11:25 +0000 (+0000), Jeremy Stanley wrote:
[...]
> Anyway, this looks like a relevant feature request for it along with
> a proof of concept implementation (albeit with 7 years of cobwebs):
> 
>     https://bugs.debian.org/766267
>     https://lists.debian.org/debian-dpkg/2014/08/threads.html#00006
> 
> The implementation looks fairly straightforward, the file signatures
> would be generated when the packages are assembled and stored with
> the file checksums normally tracked, then at installation those
> signatures would be copied into extended filesystem attributes for
> the relevant files, to be consumed by the kernel.
> 
> If this is of interest to the StarlingX community, it might be an
> activity worth reigniting in Debian. It looks like the developers at
> IBM who originally proposed support for it did not pursue it
> further, at least that I can find any record of.

A thread on the oss-security mailing list this week reminded me of
the earlier discussion here. Interestingly, it's a developer at Red
Hat questioning the (f)utility of IMA signatures on files:

    https://www.openwall.com/lists/oss-security/2021/11/30/1

-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20211201/77229613/attachment.sig>


More information about the Starlingx-discuss mailing list