diff options
| author |   Mimi Zohar <zohar@linux.vnet.ibm.com> | 2018-07-13 14:06:01 -0400 |
|---|---|---|
| committer |   James Morris <james.morris@microsoft.com> | 2018-07-16 12:31:57 -0700 |
| commit | ef96837b0de4af47732e2a8ebf5c18e8a885ded6 (patch) | |
| tree | 9a9f6481aae7a957d72fdbaf3e89d3c88847203f /security/selinux/hooks.c | |
| parent | ima: based on policy require signed firmware (sysfs fallback) (diff) | |
| download | linux-dev-ef96837b0de4af47732e2a8ebf5c18e8a885ded6.tar.xz linux-dev-ef96837b0de4af47732e2a8ebf5c18e8a885ded6.zip | |
ima: add build time policy
IMA by default does not measure, appraise or audit files, but can be
enabled at runtime by specifying a builtin policy on the boot command line
or by loading a custom policy.
This patch defines a build time policy, which verifies kernel modules,
firmware, kexec image, and/or the IMA policy signatures. This build time
policy is automatically enabled at runtime and persists after loading a
custom policy.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>
Diffstat (limited to 'security/selinux/hooks.c')
0 files changed, 0 insertions, 0 deletions