Skip to content

RFC integrity: Linux Integrity Module(LIM) and provider

Mimi Zohar lkml 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 RFC Latest3 patches 3 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/3integrity: API, hooks, placement and dummy providerfs/dcache.c fs/ext3/xattr_security.c fs/file_table.c +9 more+508 -00 replies
2/3integrity: IMA as an integrity service providerDocumentation/kernel-parameters.txt fs/sysfs/mount.c include/linux/magic.h +10 more+1177 -32 replies
3/3integrity:TPM internel kernel interfacedrivers/char/tpm/tpm.c drivers/char/tpm/tpm.h include/linux/tpm.h+257 -700 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [RFC][Patch 0/3] integrity: Linux Integrity Module(LIM) and provider

This is a request for comments for a subset of the original integrity patches. By submitting this subset of the original patches, we hope to simplify its review and ultimately ease its inclusion into the kernel. For this reason, neither EVM nor SLIM are included in this patchset. This patchset contains: Linux Integrity Module(LIM), Integrity Measurement Architecture (IMA), and patches to the TPM driver. The LIM patch defines 3 integrity API calls, 7 integrity hooks, placement of the hooks, and a dummy integrity service provider. There are very minor changes from the previous release. The IMA patch is now an independent integrity service provider, which provides support for a subset of the integrity API calls.

IBAC, a sample LSM module, which helps clarify the interaction between LSM and LIM modules, will be posted separately to the LSM mailing list. In addition, we are working on an SELinux integrity patch to take advantage of the integrity services, in a similar way to the IBAC example.

Patch 1/3 integrity: Linux Integrity Module (LIM)
Patch 2/3 integrity: IMA as a stand alone integrity service provider Patch 3/3 integrity: TPM internal kernel interface

Mimi Zohar
Dave Safford

Read the cover letter in its thread