Pull integrity fixes from Mimi Zohar: "Two additional patches to fix the removal of the deprecated IMA_TRUSTED_KEYRING Kconfig" * tag 'integrity-v6.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: rework CONFIG_IMA dependency block ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
Unified · Split
| @@ -29,9 +29,11 @@ config IMA · 28 unmodified lines | |||
| 29 | to learn more about IMA. | 29 | to learn more about IMA. |
| 30 | If unsure, say N. | 30 | If unsure, say N. |
| 31 | 31 | ||
| 32 | if IMA | ||
| 33 | |||
| 32 | config IMA_KEXEC | 34 | config IMA_KEXEC |
| 33 | bool "Enable carrying the IMA measurement list across a soft boot" | 35 | bool "Enable carrying the IMA measurement list across a soft boot" |
| 34 | depends on IMA && TCG_TPM && HAVE_IMA_KEXEC | 36 | depends on TCG_TPM && HAVE_IMA_KEXEC |
| 35 | default n | 37 | default n |
| 36 | help | 38 | help |
| 37 | TPM PCRs are only reset on a hard reboot. In order to validate | 39 | TPM PCRs are only reset on a hard reboot. In order to validate |
| @@ -43,7 +45,6 @@ config IMA_KEXEC · 5 unmodified lines | |||
| 43 | 45 | ||
| 44 | config IMA_MEASURE_PCR_IDX | 46 | config IMA_MEASURE_PCR_IDX |
| 45 | int | 47 | int |
| 46 | depends on IMA | ||
| 47 | range 8 14 | 48 | range 8 14 |
| 48 | default 10 | 49 | default 10 |
| 49 | help | 50 | help |
| @@ -53,7 +54,7 @@ config IMA_MEASURE_PCR_IDX · 3 unmodified lines | |||
| 53 | 54 | ||
| 54 | config IMA_LSM_RULES | 55 | config IMA_LSM_RULES |
| 55 | bool | 56 | bool |
| 56 | depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR) | 57 | depends on AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR) |
| 57 | default y | 58 | default y |
| 58 | help | 59 | help |
| 59 | Disabling this option will disregard LSM based policy rules. | 60 | Disabling this option will disregard LSM based policy rules. |
| @@ -61,7 +62,6 @@ config IMA_LSM_RULES · 1 unmodified line | |||
| 61 | choice | 62 | choice |
| 62 | prompt "Default template" | 63 | prompt "Default template" |
| 63 | default IMA_NG_TEMPLATE | 64 | default IMA_NG_TEMPLATE |
| 64 | depends on IMA | ||
| 65 | help | 65 | help |
| 66 | Select the default IMA measurement template. | 66 | Select the default IMA measurement template. |
| 67 | 67 | ||
| @@ -80,14 +80,12 @@ endchoice · 12 unmodified lines | |||
| 80 | 80 | ||
| 81 | config IMA_DEFAULT_TEMPLATE | 81 | config IMA_DEFAULT_TEMPLATE |
| 82 | string | 82 | string |
| 83 | depends on IMA | ||
| 84 | default "ima-ng" if IMA_NG_TEMPLATE | 83 | default "ima-ng" if IMA_NG_TEMPLATE |
| 85 | default "ima-sig" if IMA_SIG_TEMPLATE | 84 | default "ima-sig" if IMA_SIG_TEMPLATE |
| 86 | 85 | ||
| 87 | choice | 86 | choice |
| 88 | prompt "Default integrity hash algorithm" | 87 | prompt "Default integrity hash algorithm" |
| 89 | default IMA_DEFAULT_HASH_SHA1 | 88 | default IMA_DEFAULT_HASH_SHA1 |
| 90 | depends on IMA | ||
| 91 | help | 89 | help |
| 92 | Select the default hash algorithm used for the measurement | 90 | Select the default hash algorithm used for the measurement |
| 93 | list, integrity appraisal and audit log. The compiled default | 91 | list, integrity appraisal and audit log. The compiled default |
| @@ -117,7 +115,6 @@ endchoice · 23 unmodified lines | |||
| 117 | 115 | ||
| 118 | config IMA_DEFAULT_HASH | 116 | config IMA_DEFAULT_HASH |
| 119 | string | 117 | string |
| 120 | depends on IMA | ||
| 121 | default "sha1" if IMA_DEFAULT_HASH_SHA1 | 118 | default "sha1" if IMA_DEFAULT_HASH_SHA1 |
| 122 | default "sha256" if IMA_DEFAULT_HASH_SHA256 | 119 | default "sha256" if IMA_DEFAULT_HASH_SHA256 |
| 123 | default "sha512" if IMA_DEFAULT_HASH_SHA512 | 120 | default "sha512" if IMA_DEFAULT_HASH_SHA512 |
| @@ -126,7 +123,6 @@ config IMA_DEFAULT_HASH · 2 unmodified lines | |||
| 126 | 123 | ||
| 127 | config IMA_WRITE_POLICY | 124 | config IMA_WRITE_POLICY |
| 128 | bool "Enable multiple writes to the IMA policy" | 125 | bool "Enable multiple writes to the IMA policy" |
| 129 | depends on IMA | ||
| 130 | default n | 126 | default n |
| 131 | help | 127 | help |
| 132 | IMA policy can now be updated multiple times. The new rules get | 128 | IMA policy can now be updated multiple times. The new rules get |
| @@ -137,7 +133,6 @@ config IMA_WRITE_POLICY · 4 unmodified lines | |||
| 137 | 133 | ||
| 138 | config IMA_READ_POLICY | 134 | config IMA_READ_POLICY |
| 139 | bool "Enable reading back the current IMA policy" | 135 | bool "Enable reading back the current IMA policy" |
| 140 | depends on IMA | ||
| 141 | default y if IMA_WRITE_POLICY | 136 | default y if IMA_WRITE_POLICY |
| 142 | default n if !IMA_WRITE_POLICY | 137 | default n if !IMA_WRITE_POLICY |
| 143 | help | 138 | help |
| @@ -147,7 +142,6 @@ config IMA_READ_POLICY · 3 unmodified lines | |||
| 147 | 142 | ||
| 148 | config IMA_APPRAISE | 143 | config IMA_APPRAISE |
| 149 | bool "Appraise integrity measurements" | 144 | bool "Appraise integrity measurements" |
| 150 | depends on IMA | ||
| 151 | default n | 145 | default n |
| 152 | help | 146 | help |
| 153 | This option enables local measurement integrity appraisal. | 147 | This option enables local measurement integrity appraisal. |
| @@ -269,7 +263,7 @@ config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY · 115 unmodified lines | |||
| 269 | config IMA_BLACKLIST_KEYRING | 263 | config IMA_BLACKLIST_KEYRING |
| 270 | bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)" | 264 | bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)" |
| 271 | depends on SYSTEM_TRUSTED_KEYRING | 265 | depends on SYSTEM_TRUSTED_KEYRING |
| 272 | depends on IMA_TRUSTED_KEYRING | 266 | depends on INTEGRITY_TRUSTED_KEYRING |
| 273 | default n | 267 | default n |
| 274 | help | 268 | help |
| 275 | This option creates an IMA blacklist keyring, which contains all | 269 | This option creates an IMA blacklist keyring, which contains all |
| @@ -279,7 +273,7 @@ config IMA_BLACKLIST_KEYRING · 3 unmodified lines | |||
| 279 | 273 | ||
| 280 | config IMA_LOAD_X509 | 274 | config IMA_LOAD_X509 |
| 281 | bool "Load X509 certificate onto the '.ima' trusted keyring" | 275 | bool "Load X509 certificate onto the '.ima' trusted keyring" |
| 282 | depends on IMA_TRUSTED_KEYRING | 276 | depends on INTEGRITY_TRUSTED_KEYRING |
| 283 | default n | 277 | default n |
| 284 | help | 278 | help |
| 285 | File signature verification is based on the public keys | 279 | File signature verification is based on the public keys |
| @@ -304,7 +298,6 @@ config IMA_APPRAISE_SIGNED_INIT · 18 unmodified lines | |||
| 304 | 298 | ||
| 305 | config IMA_MEASURE_ASYMMETRIC_KEYS | 299 | config IMA_MEASURE_ASYMMETRIC_KEYS |
| 306 | bool | 300 | bool |
| 307 | depends on IMA | ||
| 308 | depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y | 301 | depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y |
| 309 | default y | 302 | default y |
| 310 | 303 | ||
| @@ -323,7 +316,8 @@ config IMA_SECURE_AND_OR_TRUSTED_BOOT · 12 unmodified lines | |||
| 323 | 316 | ||
| 324 | config IMA_DISABLE_HTABLE | 317 | config IMA_DISABLE_HTABLE |
| 325 | bool "Disable htable to allow measurement of duplicate records" | 318 | bool "Disable htable to allow measurement of duplicate records" |
| 326 | depends on IMA | ||
| 327 | default n | 319 | default n |
| 328 | help | 320 | help |
| 329 | This option disables htable to allow measurement of duplicate records. | 321 | This option disables htable to allow measurement of duplicate records. |
| 322 | |||
| 323 | endif | ||