On Wed, Jul 14, 2010 at 2:42 PM, Shaz<shazalive@xxxxxxxxx> wrote:This is true, the initramfs's digest cannot be validated by a remote verifier. But in my opinion there are three main reasons for don't include those files in the measurement list.
This depends on remote verifier.
On Wed, Jul 14, 2010 at 3:08 AM, Seiji Munetoh<seiji.munetoh@xxxxxxxxx>
wrote:
On Thu, Jul 8, 2010 at 10:14 PM, Mimi Zohar<zohar@xxxxxxxxxxxxxxxxxx>If initrd is measured by boot loader then changes to individual files should
wrote:
On Tue, 2010-07-06 at 17:08 +0200, Roberto Sassu wrote:The hash value of the initramfs is unstable since it was generated
This patch modifies the default policy shipped with IMA, in order toYes, the initramfs measurements are therefore redundant, as they're
avoid measurements
of files in the initial ramdisk. Those files can be measured early in
the boot process
by the bootloader.
The patch applies to latest version of the mainline kernel 2.6.35-rc4.
already included in the initramfs measurement, but perhaps, as the
number of initramfs is very limited and the individual file measurements
supplies additional information, it wouldn't hurt to keep the individual
file measurements as well. These measurements could potentially help in
identifying initramfs changes.
Would appreciate other opinions before accepting this change.
at the time of kernel installation.
So still I want to check the individual used file in initramfs.
not be measured as this IS redundant. Use the new hash of the initrd as an
integrity metric. Why would this not be enough?
Creating the initramfs is client side task and the hash value of initramfs
will vary each clients.
For me, validation of current measurements is easier than validation of
initramfs. And it seems the overhead of this redundancy is less painful.
But some system can validate (or trust) the initramfs measured by IPL.
So, I would suggest that add Kconfig option to change the default policy.
IMHO, if the eventlog contains fsmagic information for each measurements.
Verifier can skip the validation of RAMFS measurement easily.
--
Seiji
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Linux-ima-user mailing list
Linux-ima-user@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/linux-ima-user
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature