On Wed, 2024-02-14 at 15:35 +0100, Roberto Sassu wrote: > From: Roberto Sassu <roberto.sassu@xxxxxxxxxx> > > Specify the 'digest_cache_measure' boot-time policy with 'ima_policy=' in > the kernel command line to add the following rule at the beginning of the > IMA policy, before other rules: > > measure func=DIGEST_LIST_CHECK pcr=12 > > which will measure digest lists into PCR 12 (or the value in > CONFIG_IMA_DIGEST_CACHE_MEASURE_PCR_IDX). > > 'digest_cache_measure' also adds 'digest_cache=content pcr=12' to the other > measure rules, if they have a compatible IMA hook. The PCR value still > comes from CONFIG_IMA_DIGEST_CACHE_MEASURE_PCR_IDX. > > Specify 'digest_cache_appraise' to add the following rule at the beginning, > before other rules: > > appraise func=DIGEST_LIST_CHECK appraise_type=imasig|modsig > > which will appraise digest lists with IMA signatures or module-style > appended signatures. > > 'digest_cache_appraise' also adds 'digest_cache=content' to the other > appraise rules, if they have a compatible IMA hook. Defining two new built-in policies - digest_cache_measure, digest_cache_appraise - in a single patch would be acceptable, if there wasn't anything else going on. Changing other policy rules should not be made in this patch. A clear explanation as to why other policy rules need to be modified is needed. It shouldn't be hidden here. thanks, Mimi > > Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx> >
