tree 9827bd28b629bf69db447666494194d118d58e25
parent a9a4935d44b58c858a81393694bc232a96cdcbd4
author Mimi Zohar <zohar@linux.vnet.ibm.com> 1519230992 -0500
committer Mimi Zohar <zohar@linux.vnet.ibm.com> 1521801097 -0400

ima: fail signature verification based on policy

This patch addresses the fuse privileged mounted filesystems in
environments which are unwilling to accept the risk of trusting the
signature verification and want to always fail safe, but are for example
using a pre-built kernel.

This patch defines a new builtin policy named "fail_securely", which can
be specified on the boot command line as an argument to "ima_policy=".

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Dongsu Park <dongsu@kinvolk.io>
Cc: Alban Crequy <alban@kinvolk.io>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>