From: Nico Kadel-Garcia [mailto:email@example.com]
Sent: Wednesday, December 29, 2021 10:29 AM
From one of the patches:
It accomplishes this task by storing reference values coming from
software vendors and by reporting whether or not the
digest of file content or metadata calculated by IMA (or EVM) is found
among those values.
That has no use but digital rights management.
I give some clarifications.
The kernel won't enforce any policy unless you define it.
Without loading a policy, there will be no change in
your user experience.
I mentioned in the patches software vendors, as they would
be the primary source of digest lists, easy to obtain. However,
as an advanced user, you would be able to effectively use
DIGLIM, even if you build your OS from scratch, by creating
a digest list of the binaries you built.
This will be possible because you will have the ability to load
your own GPG (or RSA) keys to the kernel to verify data source
authenticity of the digest lists.
This applies if you want to enforce an IMA appraisal policy,
which denies access to the files if file verification fails. If you
want to enforce an IMA measurement policy instead, access
to the files will be always granted, regardless of whether
the digest lists are signed or not. IMA, in this case, will simply
record the execution of unknown files, in addition to the
digest lists you generated.
The IMA measurement list remains in your system, unless
you decide that your system should be remotely attested
by a remote verifier.
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Zhong Ronghua