diff options
| author | Mimi Zohar <zohar@linux.ibm.com> | 2021-12-23 20:29:56 +0300 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2022-05-05 18:49:13 +0300 |
| commit | 54f03916fb892441f9a9b579db9ad7925cdeb395 (patch) | |
| tree | 0fdee8270399ff57636479db46d5d37044373608 /arch | |
| parent | 989dc72511f7b57b94b42eabfcbe79d9070de6e3 (diff) | |
ima: permit fsverity's file digests in the IMA measurement list
Permit fsverity's file digest (a hash of struct fsverity_descriptor) to
be included in the IMA measurement list, based on the new measurement
policy rule 'digest_type=verity' option.
To differentiate between a regular IMA file hash from an fsverity's
file digest, use the new d-ngv2 format field included in the ima-ngv2
template.
The following policy rule requires fsverity file digests and specifies
the new 'ima-ngv2' template, which contains the new 'd-ngv2' field. The
policy rule may be constrained, for example based on a fsuuid or LSM
label.
measure func=FILE_CHECK digest_type=verity template=ima-ngv2
Acked-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'arch')
0 files changed, 0 insertions, 0 deletions