# Re: \[PATCH v2 5/5\] ima: enable loading of build time generated key on .ima keyring

- From: Mimi Zohar \<zohar@linux.ibm.com\>
- Date: 2021-02-18 23:03:27 
- List: linux-security-module
- Page: https://ratatoskr.run/linux-security-module/2021/02/6273482
- Thread: https://ratatoskr.run/linux-integrity/2021/02/6273426/t.md

```text
On Thu, 2021-02-18 at 17:00 -0500, Nayna Jain wrote:
> The kernel currently only loads the kernel module signing key onto
> the builtin trusted keyring. To support IMA, load the module signing
> key selectively either onto the builtin or IMA keyring based on MODULE_SIG
> or MODULE_APPRAISE_MODSIG config respectively; and loads the CA kernel
> key onto the builtin trusted keyring.
> 
> Signed-off-by: Nayna Jain <nayna@linux.ibm.com>

Always having a CA key would simplify the code.   Otherwise for the
patch set,

Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>

```