> From: Lennart Poettering [mailto:mzerq...@0pointer.de] > Sent: Monday, January 3, 2022 2:34 PM > On Mo, 03.01.22 13:07, Roberto Sassu (roberto.sa...@huawei.com) wrote: > > > That would work if all digest lists are supported by the kernel. > > The first version worked that way, I developed a simple parser > > of RPM headers, so that the kernel could process then without > > having an additional user space process. Much better in term > > of protection: no interference with other user space processes > > that should be handled with an ad-hoc LSM, no time to measure > > time to use race condition. > > Why would you need to convert the digests on-the-fly? Can't you > instead convert in an "offline" fashion, i.e. convert the RPM data > into a kernel-understood digest list, and then wrap that in a cpio for > use in an initrd? I mean, given the digests are only updated whenever > RPM updates are done it sound like something perfectly doable in an > "offline" fashion, i.e. convert at the moment of RPM update, and then > just stick the covnerted format?
IMA appraisal would fail. Currently, it succeeds because the GPG keys used to sign RPM headers are in the kernel keyring, and each RPM header has a PGP appended signature (similar to the PKCS#7 of kernel modules). It could be possible to use HMAC to protect digest lists locally generated. However, it adds a dependency on EVM and require very strong measures to avoid that the whole mechanism is circumvented: the HMAC key should be stored in hardware in the TPM, should be sealed to a system that does not let the user calculate HMACs of arbitrary files. Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Zhong Ronghua _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
