lkml.org 
[lkml]   [2016]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring
From
Date
On Tue, 2016-01-12 at 15:56 +0000, David Howells wrote:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
> > > > The name "restrict_link_by_ima_mok()" doesn't reflect that it is either
> > > > the system keyring or the IMA MOK keyring.
> > >
> > > How about restrict_link_by_ima_trusted()?
> >
> > Good. restrict_link_by_ima_trusted would only check the IMA MOK keyring
> > if it was configured.
>
> And the system keyring?

Only keys signed by the system keyring can be added to the .ima keyring,
unless IMA MOK is enabled. In that case, keys signed by either the
system or IMA MOK keyring can be added to the .ima keyring.

Mimi

\
 
 \ /
  Last update: 2016-01-12 17:41    [W:3.037 / U:0.432 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site