Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set | Date | Mon, 30 Oct 2017 09:00:29 +0000 |
| |
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> Yes, that works. Thanks! Remember is_ima_appraise_enabled() is > dependent on the "ima: require secure_boot rules in lockdown mode" > patch - http://kernsec.org/pipermail/linux-security-module-archive/201 > 7-October/003910.html.
What happens if the file in question is being accessed from a filesystem that doesn't have xattrs and doesn't provide support for appraisal? Is it rejected outright or just permitted?
David
| |