One of the key features of a "Trusted" OS is _not_ digitally signed binaries. Do some research. Trusted is a designation that generally relates to the TCSEC (Orange Book) levels of B1 or higher, which require mandatory access control (MAC). Apart from MAC, other trusted-type OS's have role-based access control and type enforcement as their key features, as well as much more granularity on system privileges and high levels of compartmentalization.

Any decent sysadmin verifies the digital signature of a piece of open source code when they download it, making an implicit trust decision about the developer in the process. Digitally signed code can still have back doors! If you're concerned about maintaining integrity, compile your code on a highly secure dev box, move it into production via read-only media, then add it to your Tripwire baseline.

Your point about unsigned binaries is misconceived.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/191/23189#23189