Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-27 Thread David Safford
On Thu, 2007-03-22 at 23:19 +, Pavel Machek wrote: > > There are some papers and related userspace code at > >http://www.research.ibm.com/gsal/tcpa > > which describe the architecture in more detail, but basically this > > integrity provider is designed to complement mandatory access contr

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-27 Thread Pavel Machek
Hi! > > > > + The Extended Verification Module is an integrity provider. > > > > + An extensible set of extended attributes, as defined in > > > > + /etc/evm.conf, are HMAC protected against modification > > > > + using the TPM's KERNEL ROOT KEY, if configured, or w

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-26 Thread Mimi Zohar
On Mon, 2007-03-26 at 13:23 -0500, Serge E. Hallyn wrote: > Quoting Andrew Morton ([EMAIL PROTECTED]): > > On Fri, 23 Mar 2007 12:09:36 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > > > > > This is a re-release of EVM as an integrity service provider. > > > > What a huge set of patches. > > > >

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-26 Thread Serge E. Hallyn
Quoting Andrew Morton ([EMAIL PROTECTED]): > On Fri, 23 Mar 2007 12:09:36 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > > > This is a re-release of EVM as an integrity service provider. > > What a huge set of patches. > > Frankly, I don't know how we're going to get these reviewed and mergeable

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-26 Thread David Safford
On Sun, 2007-03-25 at 12:13 +, Pavel Machek wrote: > > > + The Extended Verification Module is an integrity provider. > > > + An extensible set of extended attributes, as defined in > > > + /etc/evm.conf, are HMAC protected against modification > > > + using the TPM's KERNEL ROOT KEY, i

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-26 Thread Mimi Zohar
On Sun, 2007-03-25 at 21:28 -0800, Andrew Morton wrote: > On Sun, 25 Mar 2007 23:13:02 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > > > On Sun, 2007-03-25 at 00:16 -0800, Andrew Morton wrote: > > > On Fri, 23 Mar 2007 12:09:36 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > > > > > > > +++ linux-2

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-25 Thread Andrew Morton
On Sun, 25 Mar 2007 23:13:02 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > On Sun, 2007-03-25 at 00:16 -0800, Andrew Morton wrote: > > On Fri, 23 Mar 2007 12:09:36 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > > > > > +++ linux-2.6.21-rc4-mm1/security/evm/Kconfig > > > @@ -0,0 +1,17 @@ > > > +con

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-25 Thread Mimi Zohar
On Sun, 2007-03-25 at 00:16 -0800, Andrew Morton wrote: > On Fri, 23 Mar 2007 12:09:36 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > > > +++ linux-2.6.21-rc4-mm1/security/evm/Kconfig > > @@ -0,0 +1,17 @@ > > +config INTEGRITY_EVM > > + boolean "EVM support" > > + depends on INTEGRITY && KEYS >

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-25 Thread Pavel Machek
Hi! > > +++ linux-2.6.21-rc4-mm1/security/evm/Kconfig > > @@ -0,0 +1,17 @@ > > +config INTEGRITY_EVM > > + boolean "EVM support" > > + depends on INTEGRITY && KEYS > > + select CRYPTO_HMAC > > + select CRYPTO_MD5 > > + select CRYPTO_SHA1 > > + default 0 > > + help > > + The Exten

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-25 Thread Andrew Morton
On Fri, 23 Mar 2007 12:09:36 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > +++ linux-2.6.21-rc4-mm1/security/evm/Kconfig > @@ -0,0 +1,17 @@ > +config INTEGRITY_EVM > + boolean "EVM support" > + depends on INTEGRITY && KEYS > + select CRYPTO_HMAC > + select CRYPTO_MD5 > + select

Re: [Patch 3/7] integrity: EVM as an integrity service provider

2007-03-25 Thread Andrew Morton
On Fri, 23 Mar 2007 12:09:36 -0400 Mimi Zohar <[EMAIL PROTECTED]> wrote: > This is a re-release of EVM as an integrity service provider. What a huge set of patches. Frankly, I don't know how we're going to get these reviewed and mergeable and merged - there doesn't seem to be a lot of interest a

[Patch 3/7] integrity: EVM as an integrity service provider

2007-03-23 Thread Mimi Zohar
This is a re-release of EVM as an integrity service provider. The initial EVM release was as an LSM module. It has been substantially rewritten to provide support for the new integrity service framework API, which permits applications, such as LSM modules, to verify the integrity of the metadata a