linux-kernel - Re: [PATCH] IMA: Use the system trusted keyrings instead of .ima

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1459962349.3166.25.camel@linux.vnet.ibm.com>
Date:	Wed, 06 Apr 2016 13:05:49 -0400
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	David Howells <dhowells@...hat.com>
Cc:	linux-security-module@...r.kernel.org, keyrings@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] IMA: Use the system trusted keyrings instead of
 .ima_mok (update)

On Wed, 2016-04-06 at 17:24 +0100, David Howells wrote:
> Looking in digsig.c, I see:
> 
> 	#ifdef CONFIG_INTEGRITY_TRUSTED_KEYRING
> 	static bool init_keyring __initdata = true;
> 	#else
> 	static bool init_keyring __initdata;
> 	#endif
> 
> Since this doesn't ever appear to be altered, should integrity_init_keyring()
> just be made conditionally compiled?

I'm not sure what you're asking.  If you're asking if the whole file can
be include based on whether this option is enabled, then no.

Mimi