Re: [PATCH 2/2] ima: Support appraise_type=imasig_optional

From: Mimi Zohar
Date: Wed Feb 13 2013 - 09:06:16 EST

On Wed, 2013-02-13 at 15:36 +0200, Kasatkin, Dmitry wrote:
> It should not be the only line in the policy.
> Can you share full policy?

> On Wed, Feb 13, 2013 at 3:29 PM, Vivek Goyal <vgoyal@xxxxxxxxxx> wrote:
> >
> > appraise fowner=0 func=BPRM_CHECK appraise_type=imasig_optional

Different use cases require different policies. Our concern is that
appraising file integrity not be added to the kernel in an ad-hoc

This rule implements the intent of the original patches Vivek posted.
We might personally disagree with the intent, but that is a totally
separate discussion - one that should have been raised when he posted
the original patches.



To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at