From: Tyler Hicks <tyhicks@linux.microsoft.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Cc: zohar@linux.ibm.com, stephen.smalley.work@gmail.com,
casey@schaufler-ca.com, sashal@kernel.org, jmorris@namei.org,
linux-integrity@vger.kernel.org, selinux@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v5 4/4] IMA: Handle early boot data measurement
Date: Thu, 30 Jul 2020 15:04:36 -0500 [thread overview]
Message-ID: <20200730200436.GY4181@sequoia> (raw)
In-Reply-To: <ea3bba66-9b21-b842-990b-2bf1e4ac2179@linux.microsoft.com>
On 2020-07-30 11:02:50, Lakshmi Ramasubramanian wrote:
> On 7/29/20 8:47 PM, Lakshmi Ramasubramanian wrote:
>
> Hi Tyler,
>
> > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> > index 080c53545ff0..86cba844f73c 100644
> > --- a/security/integrity/ima/Kconfig
> > +++ b/security/integrity/ima/Kconfig
> > @@ -322,10 +322,9 @@ config IMA_MEASURE_ASYMMETRIC_KEYS
> > depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
> > default y
> > -config IMA_QUEUE_EARLY_BOOT_KEYS
> > +config IMA_QUEUE_EARLY_BOOT_DATA
> > bool
> > - depends on IMA_MEASURE_ASYMMETRIC_KEYS
> > - depends on SYSTEM_TRUSTED_KEYRING
> > + depends on SECURITY || (IMA_MEASURE_ASYMMETRIC_KEYS && SYSTEM_TRUSTED_KEYRING)
> > default y
> Similar to the change you'd suggested for validating LSM_STATE and
> LSM_POLICY func, I think IMA_QUEUE_EARLY_BOOT_DATA config should be enabled
> for SECURITY_SELINUX.
>
> depends on SECURITY_SELINUX ||
> (IMA_MEASURE_ASYMMETRIC_KEYS && SYSTEM_TRUSTED_KEYRING)
>
> And, when more security modules are added update this CONFIG as appropriate.
>
> Does that sound okay?
Yes, I think so.
Tyler
>
> -lakshmi
prev parent reply other threads:[~2020-07-30 20:04 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-30 3:47 [PATCH v5 0/4] LSM: Measure security module data Lakshmi Ramasubramanian
2020-07-30 3:47 ` [PATCH v5 1/4] IMA: Add func to measure LSM state and policy Lakshmi Ramasubramanian
2020-07-30 15:02 ` Tyler Hicks
2020-07-30 15:15 ` Lakshmi Ramasubramanian
2020-07-30 15:17 ` Tyler Hicks
2020-07-30 16:19 ` Casey Schaufler
2020-07-30 16:33 ` Lakshmi Ramasubramanian
2020-07-30 3:47 ` [PATCH v5 2/4] IMA: Define IMA hooks " Lakshmi Ramasubramanian
2020-07-30 15:04 ` Tyler Hicks
2020-07-30 3:47 ` [PATCH v5 3/4] LSM: Define SELinux function to measure " Lakshmi Ramasubramanian
2020-08-03 15:11 ` Stephen Smalley
2020-08-03 16:14 ` Lakshmi Ramasubramanian
2020-08-03 20:00 ` Stephen Smalley
2020-08-03 20:29 ` Stephen Smalley
2020-08-03 20:37 ` Lakshmi Ramasubramanian
2020-08-03 21:07 ` Stephen Smalley
2020-08-03 22:08 ` Lakshmi Ramasubramanian
2020-08-04 15:20 ` Stephen Smalley
2020-08-04 15:29 ` Stephen Smalley
2020-08-04 15:57 ` Lakshmi Ramasubramanian
2020-07-30 3:47 ` [PATCH v5 4/4] IMA: Handle early boot data measurement Lakshmi Ramasubramanian
2020-07-30 18:02 ` Lakshmi Ramasubramanian
2020-07-30 20:04 ` Tyler Hicks [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200730200436.GY4181@sequoia \
--to=tyhicks@linux.microsoft.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=nramas@linux.microsoft.com \
--cc=sashal@kernel.org \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.