summaryrefslogtreecommitdiff
path: root/security/integrity/ima/Kconfig
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.vnet.ibm.com>2013-08-13 08:47:43 -0400
committerMimi Zohar <zohar@linux.vnet.ibm.com>2013-10-31 20:20:48 -0400
commit217091dd7a7a1bdac027ddb7c5a25f6ac0b8e241 (patch)
tree3a8a39da527431153698fc73640db47e8a1bd43a /security/integrity/ima/Kconfig
parentbcbc9b0cf6d8f340a1d166e414f4612b353f7a9b (diff)
downloadlinux-next-217091dd7a7a1bdac027ddb7c5a25f6ac0b8e241.tar.gz
ima: define '_ima' as a builtin 'trusted' keyring
Require all keys added to the IMA keyring be signed by an existing trusted key on the system trusted keyring. Changelog: - define stub integrity_init_keyring() function (reported-by Fengguang Wu) - differentiate between regular and trusted keyring names. - replace printk with pr_info (D. Kasatkin) Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Diffstat (limited to 'security/integrity/ima/Kconfig')
-rw-r--r--security/integrity/ima/Kconfig8
1 files changed, 8 insertions, 0 deletions
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index 81a27971d884..dad8d4ca2437 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -123,3 +123,11 @@ config IMA_APPRAISE
For more information on integrity appraisal refer to:
<http://linux-ima.sourceforge.net>
If unsure, say N.
+
+config IMA_TRUSTED_KEYRING
+ bool "Require all keys on the _ima keyring be signed"
+ depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
+ default y
+ help
+ This option requires that all keys added to the _ima
+ keyring be signed by a key on the system trusted keyring.