summaryrefslogtreecommitdiff
path: root/security/integrity/ima/Kconfig
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.ibm.com>2020-01-23 17:24:35 -0500
committerMimi Zohar <zohar@linux.ibm.com>2020-01-23 17:24:35 -0500
commitd54e17b4066612d88c4ef3e5fb3115f12733763d (patch)
tree3290001b6ae913d289b6eedb60f59acce50d64bf /security/integrity/ima/Kconfig
parent5c7bac9fb2c5929a3b8600c45a972aabf9f410b5 (diff)
parent5b3014b95272a432b7705142f7081967fc1547f9 (diff)
Merge branch 'next-integrity.defer-measuring-keys' into next-integrity
From patch set cover letter: The IMA subsystem supports measuring asymmetric keys when the key is created or updated[1]. But keys created or updated before a custom IMA policy is loaded are currently not measured. This includes keys added, for instance, to either the .ima or .builtin_trusted_keys keyrings, which happens early in the boot process. Measuring the early boot keys, by design, requires loading a custom IMA policy. This change adds support for queuing keys created or updated before a custom IMA policy is loaded. The queued keys are processed when a custom policy is loaded. Keys created or updated after a custom policy is loaded are measured immediately (not queued). In the case when a custom policy is not loaded within 5 minutes of IMA initialization, the queued keys are freed. [1] https://lore.kernel.org/linux-integrity/20191211164707.4698-1-nramas@linux.microsoft.com/
Diffstat (limited to 'security/integrity/ima/Kconfig')
-rw-r--r--security/integrity/ima/Kconfig6
1 files changed, 6 insertions, 0 deletions
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index 355754a6b6ca..711ff10fa36e 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -316,3 +316,9 @@ config IMA_MEASURE_ASYMMETRIC_KEYS
depends on IMA
depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
default y
+
+config IMA_QUEUE_EARLY_BOOT_KEYS
+ bool
+ depends on IMA_MEASURE_ASYMMETRIC_KEYS
+ depends on SYSTEM_TRUSTED_KEYRING
+ default y