Hi Michael, On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote: > 'ima-modsig' was not in the list of selectable templates in Kconfig. > The missing Kconfig options were added to support the ima-modsig > template as default template. > > Signed-off-by: Michael Weiß <michael.weiss@xxxxxxxxxxxxxxxxxxx> Since 'ima-modsig' is only needed for appended signatures (e.g. kexec kernel image on powerpc, kernel modules) a per policy rule "template=" option was defined. There's also the 'ima_template=' boot command line option. Between these two options, I didn't see the need for making it a build time default option. Do you? The patch itself looks good. thanks, Mimi > --- > security/integrity/ima/Kconfig | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > index 12e9250c1bec..32b9325f49bf 100644 > --- a/security/integrity/ima/Kconfig > +++ b/security/integrity/ima/Kconfig > @@ -78,6 +78,8 @@ choice > bool "ima-ng (default)" > config IMA_SIG_TEMPLATE > bool "ima-sig" > + config IMA_MODSIG_TEMPLATE > + bool "ima-modsig" > endchoice > > config IMA_DEFAULT_TEMPLATE > @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE > default "ima" if IMA_TEMPLATE > default "ima-ng" if IMA_NG_TEMPLATE > default "ima-sig" if IMA_SIG_TEMPLATE > + default "ima-modsig" if IMA_MODSIG_TEMPLATE > > choice > prompt "Default integrity hash algorithm"
