diff options
| author | Lakshmi Ramasubramanian <nramas@linux.microsoft.com> | 2021-01-07 20:07:07 -0800 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2021-01-14 23:41:43 -0500 |
| commit | 03cee168366621db85000cec47f5cefdb83e049b (patch) | |
| tree | 8354f0f679bc9e85a986b26d803bfc9da0e5b9f8 /Documentation/admin-guide | |
| parent | 9f5d7d23cc5ec61a92076b73665fcb9aaa5bb5a0 (diff) | |
| download | linux-03cee168366621db85000cec47f5cefdb83e049b.tar.gz | |
IMA: define a builtin critical data measurement policy
Define a new critical data builtin policy to allow measuring early kernel integrity critical data before a custom IMA policy is loaded. Update the documentation on kernel parameters to document the new critical data builtin policy. Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'Documentation/admin-guide')
| -rw-r--r-- | Documentation/admin-guide/kernel-parameters.txt | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 9e3cdb271d06..65a0c4c9ab18 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1746,7 +1746,7 @@ ima_policy= [IMA] The builtin policies to load during IMA setup. Format: "tcb | appraise_tcb | secure_boot | - fail_securely" + fail_securely | critical_data" The "tcb" policy measures all programs exec'd, files mmap'd for exec, and all files opened with the read @@ -1765,6 +1765,9 @@ filesystems with the SB_I_UNVERIFIABLE_SIGNATURE flag. + The "critical_data" policy measures kernel integrity + critical data. + ima_tcb [IMA] Deprecated. Use ima_policy= instead. Load a policy which meets the needs of the Trusted Computing Base. This means IMA will measure all |