Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG

2017-10-25 Thread Bruno E. O. Meneguele
On 25-10, Mimi Zohar wrote: > On Wed, 2017-10-25 at 13:05 -0200, Bruno E. O. Meneguele wrote: > > On 24-10, Mimi Zohar wrote: > > > On Tue, 2017-10-24 at 15:37 -0200, Bruno E. O. Meneguele wrote: > > > > When the user requests MODULE_CHECK policy and its kernel is compiled > > > > with CONFIG_MODUL

Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG

2017-10-25 Thread Mimi Zohar
On Wed, 2017-10-25 at 13:05 -0200, Bruno E. O. Meneguele wrote: > On 24-10, Mimi Zohar wrote: > > On Tue, 2017-10-24 at 15:37 -0200, Bruno E. O. Meneguele wrote: > > > When the user requests MODULE_CHECK policy and its kernel is compiled > > > with CONFIG_MODULE_SIG_FORCE not set, all modules would

Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG

2017-10-25 Thread Bruno E. O. Meneguele
On 24-10, Mimi Zohar wrote: > On Tue, 2017-10-24 at 15:37 -0200, Bruno E. O. Meneguele wrote: > > When the user requests MODULE_CHECK policy and its kernel is compiled > > with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just > > those loaded in initram time. One option the user wo

Re: [PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG

2017-10-24 Thread Mimi Zohar
On Tue, 2017-10-24 at 15:37 -0200, Bruno E. O. Meneguele wrote: > When the user requests MODULE_CHECK policy and its kernel is compiled > with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just > those loaded in initram time. One option the user would have would be > set a kernel cmd

[PATCH v3 2/2] ima: check signature enforcement against cmdline param instead of CONFIG

2017-10-24 Thread Bruno E. O. Meneguele
When the user requests MODULE_CHECK policy and its kernel is compiled with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just those loaded in initram time. One option the user would have would be set a kernel cmdline param (module.sig_enforce) to true, but the IMA module check code d