From: Mimi Zohar <zohar@linux.vnet.ibm.com> To: linux-ima-devel@lists.sourceforge.net Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, David Howells <dhowells@redhat.com>, Dave Young <dyoung@redhat.com> Subject: [PATCH 3/4] ima: define Kconfig IMA_APPRAISE_BOOTPARAM option Date: Tue, 2 May 2017 14:47:11 -0400 [thread overview] Message-ID: <1493750832-11981-4-git-send-email-zohar@linux.vnet.ibm.com> (raw) In-Reply-To: <1493750832-11981-1-git-send-email-zohar@linux.vnet.ibm.com> Permit enabling the different "ima_appraise=" modes (eg. log, fix) from the boot command line. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> --- security/integrity/ima/Kconfig | 8 ++++++++ security/integrity/ima/ima_appraise.c | 2 ++ 2 files changed, 10 insertions(+) diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 370eb2f4dd37..8b688a26033d 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -155,6 +155,14 @@ config IMA_APPRAISE <http://linux-ima.sourceforge.net> If unsure, say N. +config IMA_APPRAISE_BOOTPARAM + bool "ima_appraise boot parameter" + depends on IMA_APPRAISE + default y + help + This option enables the different "ima_appraise=" modes + (eg. fix, log) from the boot command line. + config IMA_TRUSTED_KEYRING bool "Require all keys on the .ima keyring be signed (deprecated)" depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 5d0785cfe063..ac546df73afc 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -20,12 +20,14 @@ static int __init default_appraise_setup(char *str) { +#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM if (strncmp(str, "off", 3) == 0) ima_appraise = 0; else if (strncmp(str, "log", 3) == 0) ima_appraise = IMA_APPRAISE_LOG; else if (strncmp(str, "fix", 3) == 0) ima_appraise = IMA_APPRAISE_FIX; +#endif return 1; } -- 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: zohar@linux.vnet.ibm.com (Mimi Zohar) To: linux-security-module@vger.kernel.org Subject: [PATCH 3/4] ima: define Kconfig IMA_APPRAISE_BOOTPARAM option Date: Tue, 2 May 2017 14:47:11 -0400 [thread overview] Message-ID: <1493750832-11981-4-git-send-email-zohar@linux.vnet.ibm.com> (raw) In-Reply-To: <1493750832-11981-1-git-send-email-zohar@linux.vnet.ibm.com> Permit enabling the different "ima_appraise=" modes (eg. log, fix) from the boot command line. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> --- security/integrity/ima/Kconfig | 8 ++++++++ security/integrity/ima/ima_appraise.c | 2 ++ 2 files changed, 10 insertions(+) diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 370eb2f4dd37..8b688a26033d 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -155,6 +155,14 @@ config IMA_APPRAISE <http://linux-ima.sourceforge.net> If unsure, say N. +config IMA_APPRAISE_BOOTPARAM + bool "ima_appraise boot parameter" + depends on IMA_APPRAISE + default y + help + This option enables the different "ima_appraise=" modes + (eg. fix, log) from the boot command line. + config IMA_TRUSTED_KEYRING bool "Require all keys on the .ima keyring be signed (deprecated)" depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 5d0785cfe063..ac546df73afc 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -20,12 +20,14 @@ static int __init default_appraise_setup(char *str) { +#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM if (strncmp(str, "off", 3) == 0) ima_appraise = 0; else if (strncmp(str, "log", 3) == 0) ima_appraise = IMA_APPRAISE_LOG; else if (strncmp(str, "fix", 3) == 0) ima_appraise = IMA_APPRAISE_FIX; +#endif return 1; } -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2017-05-02 18:48 UTC|newest] Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-05-02 18:47 [PATCH 0/4] ima: builtin policy requiring file signatures Mimi Zohar 2017-05-02 18:47 ` Mimi Zohar 2017-05-02 18:47 ` [PATCH 1/4] ima: extend the "ima_policy" boot command line to support multiple policies Mimi Zohar 2017-05-02 18:47 ` Mimi Zohar 2017-05-02 18:47 ` [PATCH 2/4] ima: define a set of appraisal rules requiring file signatures Mimi Zohar 2017-05-02 18:47 ` Mimi Zohar 2017-05-02 18:47 ` Mimi Zohar [this message] 2017-05-02 18:47 ` [PATCH 3/4] ima: define Kconfig IMA_APPRAISE_BOOTPARAM option Mimi Zohar 2017-05-02 18:47 ` [PATCH 4/4] ima: define is_ima_appraise_enabled() Mimi Zohar 2017-05-02 18:47 ` Mimi Zohar
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1493750832-11981-4-git-send-email-zohar@linux.vnet.ibm.com \ --to=zohar@linux.vnet.ibm.com \ --cc=dhowells@redhat.com \ --cc=dyoung@redhat.com \ --cc=linux-ima-devel@lists.sourceforge.net \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.