LWN: Comments on "The integrity policy enforcement security module"

The integrity policy enforcement security module

intelfx — Mon, 20 Apr 2020 04:08:56 +0000

> policy_name="Evil lockdown policy" policy_version=6.6.6

So... lampshading much?

The integrity policy enforcement security module

Fowl — Fri, 17 Apr 2020 07:18:32 +0000

Interesting that this is from Microsoft, as they've gone down the path of "enlightening" interpreters for their "Defender Application Guard" feature in Windows. Although that is more tied to hashes/signatures on each executable instead of disk images.

The integrity policy enforcement security module

Fowl — Fri, 17 Apr 2020 07:15:35 +0000

There's a little bit of discussion of this in the "Known Gaps" and "Future" sections of announcement email.

The integrity policy enforcement security module

martin.pitt — Fri, 17 Apr 2020 05:09:01 +0000

Thank you for the nice article! This sounds like even with a super-strict policy you can still execute arbitrary code through installed interpreters, right? (sh, python, etc.) That is if course conceptually difficult to control at the kernel security policy layer.