• Eric Richter's avatar
    ima: add policy support for extending different pcrs · 0260643c
    Eric Richter authored
    This patch defines a new IMA measurement policy rule option "pcr=",
    which allows extending different PCRs on a per rule basis. For example,
    the system independent files could extend the default IMA Kconfig
    specified PCR, while the system dependent files could extend a different
    PCR.
    
    The following is an example of this usage with an SELinux policy; the
    rule would extend PCR 11 with system configuration files:
    
      measure func=FILE_CHECK mask=MAY_READ obj_type=system_conf_t pcr=11
    
    Changelog v3:
    - FIELD_SIZEOF returns bytes, not bits. Fixed INVALID_PCR
    Signed-off-by: default avatarEric Richter <erichte@linux.vnet.ibm.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
    0260643c
ima_policy.c 28.5 KB