> > Or reflect that IMA-appraisal, if enabled, will enforce firmware being > > validly signed. > > But FWICT lockdown is a built-in kernel thingy, unless lockdown implies IMA > it would not be the place to refer to it. > > It seems the documentation was proposed to help users if an error was caught. > That error should cover only what is being addressed in code on the kernel. Enabling "lockdown" needs to take into account IMA-appraisal to prevent breaking systems with it enabled. An IMA builtin "secure_boot" policy was already upstreamed (commit 503ceaef8e2e "ima: define a set of appraisal rules requiring file signatures"). An additional patch, automatically enables the "secure_boot" policy in "lockdown" mode. Refer to this discussion and patch: http://kernsec.org/pipermail/linux-security-module-archive/2017-October/003913.html http://kernsec.org/pipermail/linux-security-module-archive/2017-October/003910.html thanks, Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
