From: Bruno Meneguele <bmeneg@xxxxxxxxxx> redhat/configs: enable IMA_ARCH_POLICY for aarch64 and s390x IMA_ARCH_POLICY was already enabled for x86_64 and ppc64le. Recently, the IMA code handling EFI was unified under security/integrity/ima/ima_efi.c and aarch64 with CONFIG_EFI can use it for the IMA_ARCH_POLICY logic. In somewhat the same way, s390x has all the bits in upstream to enable IMA_ARCH_POLICY, which is tied with the IMA_SECURE_AND_OR_TRUSTED_BOOT that s390x supports with its IPL mode and also make use during KEXEC'ing a kernel image in their secure boot. With that, I'm proactivelly enabling IMA_ARCH_POLICY for s390x as well. Signed-off-by: Bruno Meneguele <bmeneg@xxxxxxxxxx> diff --git a/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY b/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY index blahblah..blahblah 100644 --- a/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY +++ b/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY @@ -1 +1 @@ -# CONFIG_IMA_ARCH_POLICY is not set +CONFIG_IMA_ARCH_POLICY=y diff --git a/redhat/configs/common/generic/powerpc/CONFIG_IMA_ARCH_POLICY b/redhat/configs/common/generic/powerpc/CONFIG_IMA_ARCH_POLICY deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/common/generic/powerpc/CONFIG_IMA_ARCH_POLICY +++ /dev/null @@ -1 +0,0 @@ -CONFIG_IMA_ARCH_POLICY=y diff --git a/redhat/configs/common/generic/x86/CONFIG_IMA_ARCH_POLICY b/redhat/configs/common/generic/x86/CONFIG_IMA_ARCH_POLICY deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/common/generic/x86/CONFIG_IMA_ARCH_POLICY +++ /dev/null @@ -1 +0,0 @@ -CONFIG_IMA_ARCH_POLICY=y -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1216 _______________________________________________ kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
