Re: [PATCH 2/6] ima: Return INTEGRITY_FAIL if digital signature can't be verified

2013-03-05 Thread Vivek Goyal
On Tue, Mar 05, 2013 at 08:30:53AM -0500, Mimi Zohar wrote: > On Mon, 2013-03-04 at 11:20 -0500, Vivek Goyal wrote: > > On Mon, Mar 04, 2013 at 08:48:36AM -0500, Mimi Zohar wrote: > > > On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote: > > > > Digital signature verification happens using integr

Re: [PATCH 2/6] ima: Return INTEGRITY_FAIL if digital signature can't be verified

2013-03-05 Thread Mimi Zohar
On Tue, 2013-03-05 at 08:30 -0500, Mimi Zohar wrote: > Digital signature verification happens using integrity_digsig_verify(). > If a digital signature is present in security.ima, then any error, which > happens during signature verification, should lead to status > INTEGRITY_FAIL. In the future

Re: [PATCH 2/6] ima: Return INTEGRITY_FAIL if digital signature can't be verified

2013-03-05 Thread Mimi Zohar
On Mon, 2013-03-04 at 11:20 -0500, Vivek Goyal wrote: > On Mon, Mar 04, 2013 at 08:48:36AM -0500, Mimi Zohar wrote: > > On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote: > > > Digital signature verification happens using integrity_digsig_verify(). > > > Curently we set integrity to FAIL for all

Re: [PATCH 2/6] ima: Return INTEGRITY_FAIL if digital signature can't be verified

2013-03-04 Thread Vivek Goyal
On Mon, Mar 04, 2013 at 08:48:36AM -0500, Mimi Zohar wrote: > On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote: > > Digital signature verification happens using integrity_digsig_verify(). > > Curently we set integrity to FAIL for all error codes except -EOPNOTSUPP. > > This sounds out of line.

Re: [PATCH 2/6] ima: Return INTEGRITY_FAIL if digital signature can't be verified

2013-03-04 Thread Mimi Zohar
On Thu, 2013-02-14 at 14:55 -0500, Vivek Goyal wrote: > Digital signature verification happens using integrity_digsig_verify(). > Curently we set integrity to FAIL for all error codes except -EOPNOTSUPP. > This sounds out of line. > > - If appropriate kernel code is not compiled in to verify signa

[PATCH 2/6] ima: Return INTEGRITY_FAIL if digital signature can't be verified

2013-02-14 Thread Vivek Goyal
Digital signature verification happens using integrity_digsig_verify(). Curently we set integrity to FAIL for all error codes except -EOPNOTSUPP. This sounds out of line. - If appropriate kernel code is not compiled in to verify signature of a file, then prractically it is a failed signature. -