From: Roberto Sassu <roberto.sassu@huawei.com>
To: Mimi Zohar <zohar@linux.ibm.com>, <dmitry.kasatkin@huawei.com>,
<mjg59@google.com>
Cc: <linux-integrity@vger.kernel.org>, <linux-doc@vger.kernel.org>,
<linux-security-module@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <silviu.vlasceanu@huawei.com>,
<stable@vger.kernel.org>
Subject: Re: [PATCH 3/4] ima: don't ignore INTEGRITY_UNKNOWN EVM status
Date: Tue, 21 May 2019 09:26:53 +0200 [thread overview]
Message-ID: <e81b761c-9133-a432-4d06-3cfe57e29e4b@huawei.com> (raw)
In-Reply-To: <1558387212.4039.77.camel@linux.ibm.com>
On 5/20/2019 11:20 PM, Mimi Zohar wrote:
> On Thu, 2019-05-16 at 18:12 +0200, Roberto Sassu wrote:
>> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
>> index 52e6fbb042cc..80e1c233656b 100644
>> --- a/Documentation/admin-guide/kernel-parameters.txt
>> +++ b/Documentation/admin-guide/kernel-parameters.txt
>> @@ -1588,6 +1588,9 @@
>> Format: { "off" | "enforce" | "fix" | "log" }
>> default: "enforce"
>>
>> + ima_appraise_req_evm
>> + [IMA] require EVM for appraisal with file digests.
>
> As much as possible we want to limit the number of new boot command
> line options as possible. Is there a reason for not extending
> "ima_appraise=" with "require-evm" or "enforce-evm"?
ima-appraise= can be disabled with CONFIG_IMA_APPRAISE_BOOTPARAM, which
probably is done when the system is in production.
Should I allow to use ima-appraise=require-evm even if
CONFIG_IMA_APPRAISE_BOOTPARAM=n?
Thanks
Roberto
--
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI
next prev parent reply other threads:[~2019-05-21 7:26 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-16 16:12 [PATCH 1/4] evm: check hash algorithm passed to init_desc() Roberto Sassu
2019-05-16 16:12 ` [PATCH 2/4] evm: reset status in evm_inode_post_setattr() Roberto Sassu
2019-05-20 21:19 ` Mimi Zohar
2019-05-16 16:12 ` [PATCH 3/4] ima: don't ignore INTEGRITY_UNKNOWN EVM status Roberto Sassu
[not found] ` <20190517001001.9BEF620848@mail.kernel.org>
2019-05-17 0:30 ` Mimi Zohar
2019-05-17 1:07 ` Sasha Levin
2019-05-20 21:20 ` Mimi Zohar
2019-05-21 7:26 ` Roberto Sassu [this message]
2019-05-21 11:48 ` Mimi Zohar
2019-05-16 16:12 ` [PATCH 4/4] ima: only audit failed appraisal verifications Roberto Sassu
2019-05-20 21:20 ` Mimi Zohar
2019-05-21 7:32 ` Roberto Sassu
2019-05-20 21:19 ` [PATCH 1/4] evm: check hash algorithm passed to init_desc() Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e81b761c-9133-a432-4d06-3cfe57e29e4b@huawei.com \
--to=roberto.sassu@huawei.com \
--cc=dmitry.kasatkin@huawei.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@google.com \
--cc=silviu.vlasceanu@huawei.com \
--cc=stable@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.