diff options
| author | Mimi Zohar <[email protected]> | 2018-07-13 18:06:01 +0000 |
|---|---|---|
| committer | James Morris <[email protected]> | 2018-07-16 19:31:57 +0000 |
| commit | ef96837b0de4af47732e2a8ebf5c18e8a885ded6 (patch) | |
| tree | 9a9f6481aae7a957d72fdbaf3e89d3c88847203f /security/selinux/hooks.c | |
| parent | ima: based on policy require signed firmware (sysfs fallback) (diff) | |
| download | kernel-ef96837b0de4af47732e2a8ebf5c18e8a885ded6.tar.gz kernel-ef96837b0de4af47732e2a8ebf5c18e8a885ded6.zip | |
ima: add build time policy
IMA by default does not measure, appraise or audit files, but can be
enabled at runtime by specifying a builtin policy on the boot command line
or by loading a custom policy.
This patch defines a build time policy, which verifies kernel modules,
firmware, kexec image, and/or the IMA policy signatures. This build time
policy is automatically enabled at runtime and persists after loading a
custom policy.
Signed-off-by: Mimi Zohar <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Signed-off-by: James Morris <[email protected]>
Diffstat (limited to 'security/selinux/hooks.c')
0 files changed, 0 insertions, 0 deletions