Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751956AbdHAK7H (ORCPT ); Tue, 1 Aug 2017 06:59:07 -0400 Received: from lhrrgout.huawei.com ([194.213.3.17]:32474 "EHLO lhrrgout.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751881AbdHAK7F (ORCPT ); Tue, 1 Aug 2017 06:59:05 -0400 Subject: Re: [PATCH, RESEND 08/12] ima: added parser for RPM data type To: Christoph Hellwig References: <20170725154423.24845-9-roberto.sassu@huawei.com> <20170801102036.15371-1-roberto.sassu@huawei.com> <20170801102709.GA24285@infradead.org> CC: , , , , , From: Roberto Sassu Message-ID: <11206fd8-d189-deb0-ab67-aec373f8d979@huawei.com> Date: Tue, 1 Aug 2017 12:58:46 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <20170801102709.GA24285@infradead.org> Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [10.47.70.108] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090201.59805EEF.019B,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 8f564c169fb15095e8062dc0b9b77747 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1299 Lines: 30 On 8/1/2017 12:27 PM, Christoph Hellwig wrote: > On Tue, Aug 01, 2017 at 12:20:36PM +0200, Roberto Sassu wrote: >> This patch introduces a parser for RPM packages. It extracts the digests >> from the RPMTAG_FILEDIGESTS header section and converts them to binary data >> before adding them to the hash table. >> >> The advantage of this data type is that verifiers can determine who >> produced that data, as headers are signed by Linux distributions vendors. >> RPM headers signatures can be provided as digest list metadata. > > Err, parsing arbitrary file formats has no business in the kernel. The benefit of this choice is that no actions are required for Linux distribution vendors to support the solution I'm proposing, because they already provide signed digest lists (RPM headers). Since the proof of loading a digest list is the digest of the digest list (included in the list metadata), if RPM headers are converted to a different format, remote attestation verifiers cannot check the signature. If the concern is security, it would be possible to prevent unsigned RPM headers from being parsed, if the PGP key type is upstreamed (adding in CC keyrings@vger.kernel.org). Roberto -- HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Bo PENG, Qiuen PENG, Shengli WANG