aleph/lkl_linux
1
0
Fork 0
mirror of https://github.com/lkl/linux.git synced 2025-12-19 16:13:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

ima: add support for arch specific policies

Browse Source 
Builtin IMA policies can be enabled on the boot command line, and replaced
with a custom policy, normally during early boot in the initramfs. Build
time IMA policy rules were recently added. These rules are automatically
enabled on boot and persist after loading a custom policy.

There is a need for yet another type of policy, an architecture specific
policy, which is derived at runtime during kernel boot, based on the
runtime secure boot flags.  Like the build time policy rules, these rules
persist after loading a custom policy.

This patch adds support for loading an architecture specific IMA policy.

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Co-Developed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Nayna Jain
2018-10-09 23:00:36 +05:30
committed by Mimi Zohar
parent c52657d93b
commit 6191706246
2 changed files with 75 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/linux/ima.h
View File

@@ -39,6 +39,11 @@ static inline bool arch_ima_get_secureboot(void)
}
#endif
static inline const char * const *arch_get_ima_policy(void)
{
return NULL;
}
#else
static inline int ima_bprm_check(struct linux_binprm *bprm)
{