On Wed, Jan 16, 2013 at 05:35:23PM -0500, Mimi Zohar wrote: > On Tue, 2013-01-15 at 16:34 -0500, Vivek Goyal wrote: > > If a binary is signed, verify its signature. If signature is not valid, do > > not allow execution. If binary is not signed, execution is allowed > > unconditionally. > > Basically you're building the policy into the executable. Anyone can > rebuild the executable and, without signing it, install/replace an > existing one. How is this safe? The signature verification policy > needs to be defined independently of the executable.
Upon signature verification this executable will also acquire a new capability(say CAP_SIGNED). And some of the services can be allowed only if process has that new capability. (TODO item) So if somebody removes the signature and launches same executable, sure it will run but it will fail to get some of the kernel services. For example, in this case it should not be able to call sys_kexec() system call. Right now my goal is to not run anything which is not signed. For that we will need a fully signed user space. And I am not sure that's going to happen in near future, atleast for the generic case. Thanks Vivek -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
