tree db035dc7773f8b8509f87115f510ed340aef7b52
parent cf38fed1e183dd2410f62d49ae635fe593082f0c
author Thiago Jung Bauermann <bauerman@linux.ibm.com> 1561688368 -0300
committer Mimi Zohar <zohar@linux.ibm.com> 1565044821 -0400

ima: Add modsig appraise_type option for module-style appended signatures

Introduce the modsig keyword to the IMA policy syntax to specify that
a given hook should expect the file to have the IMA signature appended
to it. Here is how it can be used in a rule:

appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig

With this rule, IMA will accept either a signature stored in the extended
attribute or an appended signature.

For now, the rule above will behave exactly the same as if
appraise_type=imasig was specified. The actual modsig implementation
will be introduced separately.

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>