From: Mimi Zohar <zohar@linux.ibm.com>
To: "Michael Weiß" <michael.weiss@aisec.fraunhofer.de>
Cc: linux-integrity@vger.kernel.org,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template
Date: Mon, 15 Feb 2021 08:26:57 -0500 [thread overview]
Message-ID: <fe83fb7572e0eea7a9a9981a15c63f1f7709d714.camel@linux.ibm.com> (raw)
In-Reply-To: <20210215102305.10722-1-michael.weiss@aisec.fraunhofer.de>
Hi Michael,
On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote:
> 'ima-modsig' was not in the list of selectable templates in Kconfig.
> The missing Kconfig options were added to support the ima-modsig
> template as default template.
>
> Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
Since 'ima-modsig' is only needed for appended signatures (e.g. kexec
kernel image on powerpc, kernel modules) a per policy rule "template="
option was defined. There's also the 'ima_template=' boot command line
option. Between these two options, I didn't see the need for making
it a build time default option. Do you?
The patch itself looks good.
thanks,
Mimi
> ---
> security/integrity/ima/Kconfig | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> index 12e9250c1bec..32b9325f49bf 100644
> --- a/security/integrity/ima/Kconfig
> +++ b/security/integrity/ima/Kconfig
> @@ -78,6 +78,8 @@ choice
> bool "ima-ng (default)"
> config IMA_SIG_TEMPLATE
> bool "ima-sig"
> + config IMA_MODSIG_TEMPLATE
> + bool "ima-modsig"
> endchoice
>
> config IMA_DEFAULT_TEMPLATE
> @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE
> default "ima" if IMA_TEMPLATE
> default "ima-ng" if IMA_NG_TEMPLATE
> default "ima-sig" if IMA_SIG_TEMPLATE
> + default "ima-modsig" if IMA_MODSIG_TEMPLATE
>
> choice
> prompt "Default integrity hash algorithm"
next prev parent reply other threads:[~2021-02-15 13:29 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-15 10:23 [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template Michael Weiß
2021-02-15 13:26 ` Mimi Zohar [this message]
2021-02-15 15:36 ` Weiß, Michael
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fe83fb7572e0eea7a9a9981a15c63f1f7709d714.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=michael.weiss@aisec.fraunhofer.de \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.