Messages in this thread | | | From | Kees Cook <> | Date | Sat, 14 Jul 2018 19:28:28 -0700 | Subject | Re: [PATCH v6 6/8] ima: add build time policy |
| |
On Fri, Jul 13, 2018 at 11:06 AM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote: > IMA by default does not measure, appraise or audit files, but can be > enabled at runtime by specifying a builtin policy on the boot command line > or by loading a custom policy. > > This patch defines a build time policy, which verifies kernel modules, > firmware, kexec image, and/or the IMA policy signatures. This build time > policy is automatically enabled at runtime and persists after loading a > custom policy. > > Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
-- Kees Cook Pixel Security
| |