linux-kernel - Re: [PATCH v2 2/3] integrity: move integrity subsystem options to a separate menu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1409747724.21827.48.camel@dhcp-9-2-203-236.watson.ibm.com>
Date:	Wed, 03 Sep 2014 08:35:24 -0400
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Dmitry Kasatkin <d.kasatkin@...sung.com>
Cc:	linux-ima-devel@...ts.sourceforge.net,
	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, dmitry.kasatkin@...il.com
Subject: Re: [PATCH v2 2/3] integrity: move integrity subsystem options to a
 separate menu

On Wed, 2014-09-03 at 10:29 +0300, Dmitry Kasatkin wrote: 
> Integrity subsystem got lots of options and takes more than half
> of security menu.
> 
> This patch moves integrity subsystem options to a separate menu.
> It does not affect existing configuration. Re-configuration is
> not needed.
> 
> Changes in v2:
> - previous patch moved integrity out of the 'security' menu.
>   This version keeps integrity as a security option (Mimi).
> 
> Signed-off-by: Dmitry Kasatkin <d.kasatkin@...sung.com>
> ---
>  security/integrity/Kconfig     | 14 ++++++++++++--
>  security/integrity/evm/Kconfig |  9 +--------
>  security/integrity/ima/Kconfig |  3 +--
>  3 files changed, 14 insertions(+), 12 deletions(-)
> 
> diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
> index f79d853..a734a83 100644
> --- a/security/integrity/Kconfig
> +++ b/security/integrity/Kconfig
> @@ -1,7 +1,13 @@
>  #
>  config INTEGRITY
> -	def_bool y
> -	depends on IMA || EVM
> +	bool "Integrity subsystem support"
> +	depends on SECURITY
> +	default y
> +
> +if INTEGRITY
> +
> +menu "Options"
> +

Instead of moving everything to a separate menu, I would leave the
ability to enable/disable IMA and EVM on the security page, but move
their options to separate pages.  So unless someone wants to change the
default options, they're hidden.

There are Kconfig examples for enabling the option in the parent
directory and clicking on the option brings up a separate menu (eg. NET,
WIRELESS).

>  config INTEGRITY_SIGNATURE
>  	boolean "Digital signature verification using multiple keyrings"
> @@ -46,3 +52,7 @@ config INTEGRITY_AUDIT
> 
>  source security/integrity/ima/Kconfig
>  source security/integrity/evm/Kconfig
> +
> +endmenu
> +
> +endif   # if INTEGRITY
> diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig
> index d606f3d..df20a2f 100644
> --- a/security/integrity/evm/Kconfig
> +++ b/security/integrity/evm/Kconfig
> @@ -1,6 +1,6 @@
>  config EVM
>  	boolean "EVM support"
> -	depends on SECURITY
> +	depends on INTEGRITY

By adding the "if INTEGRITY",  the "depends on INTEGRITY" is redundant.
Please remove the depends here and in the other places.

Mimi

>  	select KEYS
>  	select ENCRYPTED_KEYS
>  	select CRYPTO_HMAC
> @@ -12,10 +12,6 @@ config EVM
> 
>  	  If you are unsure how to answer this question, answer N.
> 
> -if EVM
> -
> -menu "EVM options"
> -
>  config EVM_ATTR_FSUUID
>  	bool "FSUUID (version 2)"
>  	default y
> @@ -47,6 +43,3 @@ config EVM_EXTRA_SMACK_XATTRS
>  	  additional info to the calculation, requires existing EVM
>  	  labeled file systems to be relabeled.
> 
> -endmenu
> -
> -endif
> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> index 08758fb..2477d1e 100644
> --- a/security/integrity/ima/Kconfig
> +++ b/security/integrity/ima/Kconfig
> @@ -2,8 +2,7 @@
>  #
>  config IMA
>  	bool "Integrity Measurement Architecture(IMA)"
> -	depends on SECURITY
> -	select INTEGRITY
> +	depends on INTEGRITY
>  	select SECURITYFS
>  	select CRYPTO
>  	select CRYPTO_HMAC


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/