Messages in this thread | | | Subject | Re: [PATCH 6/8] evm: enable key retention service automatically | From | Mimi Zohar <> | Date | Tue, 04 Mar 2014 14:25:00 -0500 |
| |
On Tue, 2014-03-04 at 16:10 +0200, Dmitry Kasatkin wrote: > On Tue, Mar 4, 2014 at 4:02 AM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote: > > On Fri, 2014-02-28 at 16:59 +0200, Dmitry Kasatkin wrote: > >> If keys are not enabled, EVM is not visible in the configuration menu. > >> It may be difficult to figure out what to do unless you really know. > >> > >> Other subsystems as NFS, CIFS select keys automatically. > >> This patch does the same. > >> > >> Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> > >> --- > >> security/integrity/evm/Kconfig | 5 +++-- > >> 1 file changed, 3 insertions(+), 2 deletions(-) > >> > >> diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig > >> index 5aa9103..d35b491 100644 > >> --- a/security/integrity/evm/Kconfig > >> +++ b/security/integrity/evm/Kconfig > >> @@ -1,9 +1,10 @@ > >> config EVM > >> boolean "EVM support" > >> - depends on SECURITY && KEYS && (TRUSTED_KEYS=y || TRUSTED_KEYS=n) > > > > Including KEYS is fine, but the trusted-keys dependency is still > > required. If trusted-keys is enabled, then the TPM and trusted-keys > > must be builtin. > > > > Hello. > > EVM does not depend on trusted keys, but on encrypted keys. > There is no need for "&& (TRUSTED_KEYS=y || TRUSTED_KEYS=n)" > > Header file already provides all necessary compile time dependencies... > > ------------------------------------------------------------------------------------------------- > #if defined(CONFIG_TRUSTED_KEYS) || \ > (defined(CONFIG_TRUSTED_KEYS_MODULE) && defined(CONFIG_ENCRYPTED_KEYS_MODULE)) > extern struct key *request_trusted_key(const char *trusted_desc, > u8 **master_key, size_t *master_keylen); > #else > static inline struct key *request_trusted_key(const char *trusted_desc, > u8 **master_key, > size_t *master_keylen) > { > return ERR_PTR(-EOPNOTSUPP); > } > #endif > -------------------------------------------------------------------------------------------------
Either in the patch description or the changelog, please note the reason for removing the builtin TRUSTED_KEY dependency.
thanks,
Mimi
| |