Re: Default Deny on Executables

[miah <miah () chia-pet org>]

On Wed, Sep 14, 2005 at 08:35:04AM -0400, Dave Aitel wrote:
> By default your box can come from Dell only running EXE's that are 
> signed by vendors you trust. This wouldn't be a bad idea for a GRSec'd 
> distribution either, imo. If you assume that you can trust the kernel 
> (which is a pretty big assumption, but not everyone is Paul Starzetz) 
> you can do similar stuff without special hardware, I think. :>
>
> -dave

DigSig has basically done this.  I've never tried it out, but I'd be
interested to hear opinions of those that have.

http://disec.sourceforge.net/

#  DigSig. This is a Linux kernel module, which checks RSA digital
#  signatures of ELF binaries and libraries before they are run.
#  Binaries are to be signed with BSign.


-miah