diff options
| author |   Dmitry Kasatkin <d.kasatkin@samsung.com> | 2014-03-28 14:31:04 +0200 |
|---|---|---|
| committer |   Mimi Zohar <zohar@linux.vnet.ibm.com> | 2014-06-12 17:58:06 -0400 |
| commit | d3b33679481d52ef02311119d4342a9a1f3d84db (patch) | |
| tree | 5e23d255b52239a4d478dc8b56e49871a4b732c4 /security/integrity/evm/Kconfig | |
| parent | ima: prevent new digsig xattr from being replaced (diff) | |
| download | linux-dev-d3b33679481d52ef02311119d4342a9a1f3d84db.tar.xz linux-dev-d3b33679481d52ef02311119d4342a9a1f3d84db.zip | |
evm: replace HMAC version with attribute mask
Using HMAC version limits the posibility to arbitrarily add new
attributes such as SMACK64EXEC to the hmac calculation.
This patch replaces hmac version with attribute mask.
Desired attributes can be enabled with configuration parameter.
It allows to build kernels which works with previously labeled
filesystems.
Currently supported attribute is 'fsuuid' which is equivalent of
the former version 2.
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'security/integrity/evm/Kconfig')
| -rw-r--r-- | security/integrity/evm/Kconfig | 25 |
1 files changed, 17 insertions, 8 deletions
diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig index d35b4915b00d..0df4f7a2f1e9 100644 --- a/security/integrity/evm/Kconfig +++ b/security/integrity/evm/Kconfig @@ -12,15 +12,24 @@ config EVM If you are unsure how to answer this question, answer N. -config EVM_HMAC_VERSION - int "EVM HMAC version" +if EVM + +menu "EVM options" + +config EVM_ATTR_FSUUID + bool "FSUUID (version 2)" + default y depends on EVM - default 2 help - This options adds EVM HMAC version support. - 1 - original version - 2 - add per filesystem unique identifier (UUID) (default) + Include filesystem UUID for HMAC calculation. + + Default value is 'selected', which is former version 2. + if 'not selected', it is former version 1 - WARNING: changing the HMAC calculation method or adding + WARNING: changing the HMAC calculation method or adding additional info to the calculation, requires existing EVM - labeled file systems to be relabeled. + labeled file systems to be relabeled. + +endmenu + +endif |