Hi Mimi, On Mon, 2021-02-15 at 08:26 -0500, Mimi Zohar wrote: > Hi Michael, > > On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote: > > 'ima-modsig' was not in the list of selectable templates in Kconfig. > > The missing Kconfig options were added to support the ima-modsig > > template as default template. > > > > Signed-off-by: Michael Weiß <michael.weiss@xxxxxxxxxxxxxxxxxxx> > > Since 'ima-modsig' is only needed for appended signatures (e.g. kexec > kernel image on powerpc, kernel modules) a per policy rule "template=" > option was defined. There's also the 'ima_template=' boot command line > option. Between these two options, I didn't see the need for making > it a build time default option. Do you? The use-case I had in mind was a simple measured boot, no user-space applications, only to measure already signed modules which are already signed by modsig using a single policy line: measure func=MODULE_CHECK I thought for this purpose, we could just compile in the default template to be modsig but it wasn't selectable. I have overlooked the policy rule "template=", In the above use-case, it also just works to set the policy: measure func=MODULE_CHECK template=ima-modsig So, your are right maybe that is not necessary. Regards, Michael > > The patch itself looks good. > > thanks, > > Mimi > > > --- > > security/integrity/ima/Kconfig | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > > index 12e9250c1bec..32b9325f49bf 100644 > > --- a/security/integrity/ima/Kconfig > > +++ b/security/integrity/ima/Kconfig > > @@ -78,6 +78,8 @@ choice > > bool "ima-ng (default)" > > config IMA_SIG_TEMPLATE > > bool "ima-sig" > > + config IMA_MODSIG_TEMPLATE > > + bool "ima-modsig" > > endchoice > > > > config IMA_DEFAULT_TEMPLATE > > @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE > > default "ima" if IMA_TEMPLATE > > default "ima-ng" if IMA_NG_TEMPLATE > > default "ima-sig" if IMA_SIG_TEMPLATE > > + default "ima-modsig" if IMA_MODSIG_TEMPLATE > > > > choice > > prompt "Default integrity hash algorithm" > >
