Thread (54 messages) 54 messages, 7 authors, 2025-01-21

Re: [PATCH v6 00/15] integrity: Introduce the Integrity Digest Cache

From: Eric Snowberg <eric.snowberg@oracle.com>
Date: 2024-11-26 00:14:46
Also in: linux-doc, linux-integrity, linux-kselftest, linux-modules, linux-security-module, lkml

On Nov 19, 2024, at 3:49 AM, Roberto Sassu [off-list ref] wrote:

From: Roberto Sassu <roberto.sassu@huawei.com>

The Integrity Digest Cache can also help IMA for appraisal. IMA can simply
lookup the calculated digest of an accessed file in the list of digests
extracted from package headers, after verifying the header signature. It is
sufficient to verify only one signature for all files in the package, as
opposed to verifying a signature for each file.
Is there a way to maintain integrity over time?  Today if a CVE is discovered 
in a signed program, the program hash can be added to the blacklist keyring. 
Later if IMA appraisal is used, the signature validation will fail just for that 
program.  With the Integrity Digest Cache, is there a way to do this?  
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help