On Tue, Feb 05, 2013 at 11:55:09PM +0200, Kasatkin, Dmitry wrote: [..] > > Also I am assuming that from signed initramfs, keys will be loaded in > > appropriate keyrings and then keyring will be locked so that any > > tools from unsigned initramfs can not load additional keys. > > > > Exactly like that.
Dmitry, [ Following up on this thread after a very long time ] I was thinking about this point that keys can be loaded from signed initramfs. But how is it better than embedding the keys in kernel the way we do for module signing and lock down ima keyring before control is passed to initramfs. Reason being, that anyway a user can not put its own keys in signed initramfs. Signed initramfs will be shipped by distribution. So then it does not matter whether distribution's keys are embedded in the kernel or are loaded from signed initramfs. Thanks Vivek -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
