|| ||david safford <safford-AT-watson.ibm.com>|
|| ||Andrew Morton <akpm-AT-linux-foundation.org>|
|| ||Re: [PATCH 0/4] integrity|
|| ||Mon, 17 Nov 2008 15:42:37 -0500|
|| ||Mimi Zohar <zohar-AT-linux.vnet.ibm.com>,
linux-kernel-AT-vger.kernel.org, jmorris-AT-namei.org, hch-AT-infradead.org,
On Fri, 2008-11-14 at 14:18 -0800, Andrew Morton wrote:
> On Wed, 12 Nov 2008 22:47:10 -0500
> Mimi Zohar <email@example.com> wrote:
> > The Linux Integrity Module (LIM) Framework provides hooks
> > ...
> This all looks quite mergeable to me, although I am far from being an
> expert on security things.
> One thing which I cannot say, and which is quite important: how useful
> will all of this be to our users? Are people asking for it? Are
> people likely to enable and use it? Are they even likely to understand
> it? ;) Are any large/important customers asking for it? Are distros
> likely to enable and support it?
LIM/IMA's maintenance of a TPM hardware anchored file measurement
list is fundamental to the Trusted Computing Group's standards
efforts. Several projects have implemented the TNC (Trusted Network
Connect) and PTS (Platform Trust Services) standards (see below).
There are three demo packaged distros which have integrated these
apps, two of which are government funded (EU and US), with definite
customer interest. We are working with the RHEL team to provide
a supported, patched kernel for HAP. All of these so far have used
the old LSM based IMA, and have asked for a supported, upstreamed
implementation, with the ability to work with SELinux.
http://sourceforge.jp/projects/openpts (client and server)
http://unit.aist.go.jp/itri/knoppix/index-en.html (trusted Knoppix)
to post comments)