Pull integrity fixes from Mimi Zohar: "Two additional patches to fix the removal of the deprecated IMA_TRUSTED_KEYRING Kconfig" * tag 'integrity-v6.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: rework CONFIG_IMA dependency block ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
Unified · Split
| @@ -29,9 +29,11 @@ config IMA · 28 unmodified lines | ||
| 29 | 29 | to learn more about IMA. |
| 30 | 30 | If unsure, say N. |
| 31 | 31 | |
| 32 | +if IMA | |
| 33 | + | |
| 32 | 34 | config IMA_KEXEC |
| 33 | 35 | bool "Enable carrying the IMA measurement list across a soft boot" |
| 34 | − depends on IMA && TCG_TPM && HAVE_IMA_KEXEC | |
| 36 | + depends on TCG_TPM && HAVE_IMA_KEXEC | |
| 35 | 37 | default n |
| 36 | 38 | help |
| 37 | 39 | TPM PCRs are only reset on a hard reboot. In order to validate |
| @@ -43,7 +45,6 @@ config IMA_KEXEC · 5 unmodified lines | ||
| 43 | 45 | |
| 44 | 46 | config IMA_MEASURE_PCR_IDX |
| 45 | 47 | int |
| 46 | − depends on IMA | |
| 47 | 48 | range 8 14 |
| 48 | 49 | default 10 |
| 49 | 50 | help |
| @@ -53,7 +54,7 @@ config IMA_MEASURE_PCR_IDX · 3 unmodified lines | ||
| 53 | 54 | |
| 54 | 55 | config IMA_LSM_RULES |
| 55 | 56 | bool |
| 56 | − depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR) | |
| 57 | + depends on AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR) | |
| 57 | 58 | default y |
| 58 | 59 | help |
| 59 | 60 | Disabling this option will disregard LSM based policy rules. |
| @@ -61,7 +62,6 @@ config IMA_LSM_RULES · 1 unmodified line | ||
| 61 | 62 | choice |
| 62 | 63 | prompt "Default template" |
| 63 | 64 | default IMA_NG_TEMPLATE |
| 64 | − depends on IMA | |
| 65 | 65 | help |
| 66 | 66 | Select the default IMA measurement template. |
| 67 | 67 | |
| @@ -80,14 +80,12 @@ endchoice · 12 unmodified lines | ||
| 80 | 80 | |
| 81 | 81 | config IMA_DEFAULT_TEMPLATE |
| 82 | 82 | string |
| 83 | − depends on IMA | |
| 84 | 83 | default "ima-ng" if IMA_NG_TEMPLATE |
| 85 | 84 | default "ima-sig" if IMA_SIG_TEMPLATE |
| 86 | 85 | |
| 87 | 86 | choice |
| 88 | 87 | prompt "Default integrity hash algorithm" |
| 89 | 88 | default IMA_DEFAULT_HASH_SHA1 |
| 90 | − depends on IMA | |
| 91 | 89 | help |
| 92 | 90 | Select the default hash algorithm used for the measurement |
| 93 | 91 | list, integrity appraisal and audit log. The compiled default |
| @@ -117,7 +115,6 @@ endchoice · 23 unmodified lines | ||
| 117 | 115 | |
| 118 | 116 | config IMA_DEFAULT_HASH |
| 119 | 117 | string |
| 120 | − depends on IMA | |
| 121 | 118 | default "sha1" if IMA_DEFAULT_HASH_SHA1 |
| 122 | 119 | default "sha256" if IMA_DEFAULT_HASH_SHA256 |
| 123 | 120 | default "sha512" if IMA_DEFAULT_HASH_SHA512 |
| @@ -126,7 +123,6 @@ config IMA_DEFAULT_HASH · 2 unmodified lines | ||
| 126 | 123 | |
| 127 | 124 | config IMA_WRITE_POLICY |
| 128 | 125 | bool "Enable multiple writes to the IMA policy" |
| 129 | − depends on IMA | |
| 130 | 126 | default n |
| 131 | 127 | help |
| 132 | 128 | IMA policy can now be updated multiple times. The new rules get |
| @@ -137,7 +133,6 @@ config IMA_WRITE_POLICY · 4 unmodified lines | ||
| 137 | 133 | |
| 138 | 134 | config IMA_READ_POLICY |
| 139 | 135 | bool "Enable reading back the current IMA policy" |
| 140 | − depends on IMA | |
| 141 | 136 | default y if IMA_WRITE_POLICY |
| 142 | 137 | default n if !IMA_WRITE_POLICY |
| 143 | 138 | help |
| @@ -147,7 +142,6 @@ config IMA_READ_POLICY · 3 unmodified lines | ||
| 147 | 142 | |
| 148 | 143 | config IMA_APPRAISE |
| 149 | 144 | bool "Appraise integrity measurements" |
| 150 | − depends on IMA | |
| 151 | 145 | default n |
| 152 | 146 | help |
| 153 | 147 | This option enables local measurement integrity appraisal. |
| @@ -269,7 +263,7 @@ config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY · 115 unmodified lines | ||
| 269 | 263 | config IMA_BLACKLIST_KEYRING |
| 270 | 264 | bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)" |
| 271 | 265 | depends on SYSTEM_TRUSTED_KEYRING |
| 272 | − depends on IMA_TRUSTED_KEYRING | |
| 266 | + depends on INTEGRITY_TRUSTED_KEYRING | |
| 273 | 267 | default n |
| 274 | 268 | help |
| 275 | 269 | This option creates an IMA blacklist keyring, which contains all |
| @@ -279,7 +273,7 @@ config IMA_BLACKLIST_KEYRING · 3 unmodified lines | ||
| 279 | 273 | |
| 280 | 274 | config IMA_LOAD_X509 |
| 281 | 275 | bool "Load X509 certificate onto the '.ima' trusted keyring" |
| 282 | − depends on IMA_TRUSTED_KEYRING | |
| 276 | + depends on INTEGRITY_TRUSTED_KEYRING | |
| 283 | 277 | default n |
| 284 | 278 | help |
| 285 | 279 | File signature verification is based on the public keys |
| @@ -304,7 +298,6 @@ config IMA_APPRAISE_SIGNED_INIT · 18 unmodified lines | ||
| 304 | 298 | |
| 305 | 299 | config IMA_MEASURE_ASYMMETRIC_KEYS |
| 306 | 300 | bool |
| 307 | − depends on IMA | |
| 308 | 301 | depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y |
| 309 | 302 | default y |
| 310 | 303 | |
| @@ -323,7 +316,8 @@ config IMA_SECURE_AND_OR_TRUSTED_BOOT · 12 unmodified lines | ||
| 323 | 316 | |
| 324 | 317 | config IMA_DISABLE_HTABLE |
| 325 | 318 | bool "Disable htable to allow measurement of duplicate records" |
| 326 | − depends on IMA | |
| 327 | 319 | default n |
| 328 | 320 | help |
| 329 | 321 | This option disables htable to allow measurement of duplicate records. |
| 322 | + | |
| 323 | +endif | |