> -----Original Message----- > From: owner-linux-security-mod...@vger.kernel.org [mailto:owner-linux- > security-mod...@vger.kernel.org] On Behalf Of Joshua Brindle > Sent: Tuesday, September 1, 2015 7:13 AM > To: Paul Moore > Cc: Luis R. Rodriguez; Takashi Iwai; Ming Lei; David Howells; Peter Jones; > seli...@tycho.nsa.gov; Schaufler, Casey; Stephen Smalley; Matthew Garrett; > Kees Cook; Vojtech PavlĂk; Seth Forshee; james.l.mor...@oracle.com; Dmitry > Kasatkin; Johannes Berg; Joey Lee; Kyle McMartin; linux- > wirel...@vger.kernel.org; linux-kernel@vger.kernel.org; Andy Lutomirski; > linux- > security-mod...@vger.kernel.org; Greg Kroah-Hartman; Vitaly Kuznetsov; David > Woodhouse > Subject: Re: Linux Firmware Signing > > Paul Moore wrote: > <snip> > > > > Yes, there are lots of way we could solve the signed policy format > > issue, I just don't have one in mind at this moment. Also, to be > > honest, there are enough limitations to signing SELinux policies that > > this isn't very high onmy personal SELinux priority list.
Yes I would say this is low on my end. Especially if we can kill off Reloadable policy support on Android, my need for this goes away 100%. > > > > The fact that there are so many userspace specific parts of the policy that > never > make it into the kernel precludes any meaningful verification anyway. Yes and no. On Android, if I was able to load a policy I could grant myself capabilities that We're not possible via the userspace portions, i.e. relabeling, etc. Granted, not checking the userspace portions Is not great. In an ideal world, everything is checked. However, the main reason to doing it in the kernel is where you want your trust to be. For instance, If I trust that userspace Loader, then I need to trust that + the kernel. In the case of verifying the policy signature In the kernel, I need to trust only the kernel. As far as the desktop environment, I claim ignorance and have no input there. > > And SELinux already has a mechanism for raising the integrity of a process to > do > things like signature checking in userspace, the domain transition. If someone > wants validation of the SELinux policy they just need to eliminate every > domains > ability to load policy except for a trusted policy loader that does signature > checking. > -- > To unsubscribe from this list: send the line "unsubscribe > linux-security-module" in > the body of a message to majord...@vger.kernel.org More majordomo info at > http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/