Re: [PATCH v6 8/8] selinux: measure state and hash of the policy using IMA

2020-11-23 Thread Tushar Sugandhi
Hi James, On 2020-11-20 6:05 p.m., James Morris wrote: On Thu, 19 Nov 2020, Tushar Sugandhi wrote: an impact on the security guarantees provided by SELinux. Measuring such in-memory data structures through IMA subsystem provides a secure way for a remote attestation service to know the state o

Re: [PATCH v6 8/8] selinux: measure state and hash of the policy using IMA

2020-11-20 Thread James Morris
On Thu, 19 Nov 2020, Tushar Sugandhi wrote: > an impact on the security guarantees provided by SELinux. Measuring > such in-memory data structures through IMA subsystem provides a secure > way for a remote attestation service to know the state of the system > and also the runtime changes in the st

Re: [PATCH v6 8/8] selinux: measure state and hash of the policy using IMA

2020-11-20 Thread Lakshmi Ramasubramanian
On 11/20/20 7:49 AM, Mimi Zohar wrote: Hi Mimi, On Thu, 2020-11-19 at 15:26 -0800, Tushar Sugandhi wrote: From: Lakshmi Ramasubramanian IMA measures files and buffer data such as keys, command line arguments passed to the kernel on kexec system call, etc. While these measurements enable moni

Re: [PATCH v6 8/8] selinux: measure state and hash of the policy using IMA

2020-11-20 Thread Mimi Zohar
Hi Tushar, Lakshmi, On Thu, 2020-11-19 at 15:26 -0800, Tushar Sugandhi wrote: > From: Lakshmi Ramasubramanian > > IMA measures files and buffer data such as keys, command line arguments > passed to the kernel on kexec system call, etc. While these measurements > enable monitoring and validating

[PATCH v6 8/8] selinux: measure state and hash of the policy using IMA

2020-11-19 Thread Tushar Sugandhi
From: Lakshmi Ramasubramanian IMA measures files and buffer data such as keys, command line arguments passed to the kernel on kexec system call, etc. While these measurements enable monitoring and validating the integrity of the system, it is not sufficient. In-memory data structures maintained b