Re: [PATCH v2 7/7] ima: Support platform keyring for kernel appraisal

2018-12-12 Thread Thiago Jung Bauermann
Nayna Jain writes: > On secure boot enabled systems, the bootloader verifies the kernel > image and possibly the initramfs signatures based on a set of keys. A > soft reboot(kexec) of the system, with the same kernel image and > initramfs, requires access to the original keys to verify the > si

Re: [PATCH v2 7/7] ima: Support platform keyring for kernel appraisal

2018-12-12 Thread Mimi Zohar
On Wed, 2018-12-12 at 16:14 -0200, Thiago Jung Bauermann wrote: [snip] > Subject: [PATCH] ima: Only use the platform keyring if it's enabled > > Signed-off-by: Thiago Jung Bauermann Good catch!  Thanks. Mimi > --- > security/integrity/ima/ima_appraise.c | 3 ++- > 1 file changed, 2 insertion

Re: [PATCH v2 7/7] ima: Support platform keyring for kernel appraisal

2018-12-12 Thread Thiago Jung Bauermann
Hello, Nayna Jain writes: > On secure boot enabled systems, the bootloader verifies the kernel > image and possibly the initramfs signatures based on a set of keys. A > soft reboot(kexec) of the system, with the same kernel image and > initramfs, requires access to the original keys to verify

Re: [PATCH v2 7/7] ima: Support platform keyring for kernel appraisal

2018-12-11 Thread James Morris
On Sun, 9 Dec 2018, Nayna Jain wrote: > On secure boot enabled systems, the bootloader verifies the kernel > image and possibly the initramfs signatures based on a set of keys. A > soft reboot(kexec) of the system, with the same kernel image and > initramfs, requires access to the original keys to

[PATCH v2 7/7] ima: Support platform keyring for kernel appraisal

2018-12-08 Thread Nayna Jain
On secure boot enabled systems, the bootloader verifies the kernel image and possibly the initramfs signatures based on a set of keys. A soft reboot(kexec) of the system, with the same kernel image and initramfs, requires access to the original keys to verify the signatures. This patch allows IMA-