Re: [PATCH] ima: add a new CONFIG for loading arch-specific policies
From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2020-02-27 19:38:22
Also in:
linux-efi, linux-integrity, linux-s390, lkml
On Wed, 2020-02-26 at 15:36 -0500, Mimi Zohar wrote:
On Wed, 2020-02-26 at 11:21 -0800, Lakshmi Ramasubramanian wrote:quoted
Hi Nayna,quoted
+ +config IMA_SECURE_AND_OR_TRUSTED_BOOT + bool + depends on IMA + depends on IMA_ARCH_POLICY + default n + help + This option is selected by architectures to enable secure and/or + trusted boot based on IMA runtime policies.Why is the default for this new config "n"? Is there any reason to not turn on this config if both IMA and IMA_ARCH_POLICY are set to y?Good catch. Having "IMA_SECURE_AND_OR_TRUSTED_BOOT" depend on "IMA_ARCH_POLICY" doesn't make sense. "IMA_ARCH_POLICY" needs to be selected.
After discussing this some more with Nayna, the new Kconfig indicates that the architecture defines the arch_ima_get_secureboot() and arch_get_ima_policy() functions, but doesn't automatically enable IMA_ARCH_POLICY. The decision to enable IMA_ARCH_POLICY is left up to whoever is building the kernel. The patch, at least this aspect of it, is correct. Mimi