From: Tyler Hicks <tyhicks@linux.microsoft.com>
To: Petr Vorel <petr.vorel@gmail.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>,
linux-integrity@vger.kernel.org,
Mimi Zohar <zohar@linux.vnet.ibm.com>,
Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Subject: Re: [PATCH ima-evm-utils] boot_aggregate.test: Skip if CONFIG_IMA not enabled
Date: Tue, 27 Oct 2020 13:49:33 -0500 [thread overview]
Message-ID: <20201027184933.GA5210@sequoia> (raw)
In-Reply-To: <20201020180231.GA14580@dell5510>
On 2020-10-20 20:02:31, Petr Vorel wrote:
> Hi Mimi, Dmitry,
>
> > [Cc'ing Dmitry Eremin-Solenikov]
>
> > Hi Petr,
>
> > On Mon, 2020-10-19 at 22:08 +0200, Petr Vorel wrote:
> > > This is required, because when TPM HW available (i.e. -c /dev/tpm0),
> > > evmctl ima_boot_aggregate returns sha1:xxxx.
>
> > > skip requires to move cleanup().
>
> > > Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
>
> > Nice.
> > > ---
> > > Hi Mimi,
>
> > > this Fixes problems on current Debian, which has still disabled CONFIG_IMA
> > > (FYI [1]). I was not able to figure out how to get it working with
> > > sample-* files, but maybe there is a way.
>
> > > Although it sound strange, people may want to build and check evmctl
> > > even on a system with disabled CONFIG_IMA (both Debian and Ubuntu have
> > > outdated ima-evm-utils (1.1)).
>
> > Oops, I need to keep Dmitry in the loop better. I'm hoping to release
> > v1.3 shortly.
> Thanks!
> @Dmitry do you wish to be Cc: before release or any other time?
>
> > > Kind regards,
> > > Petr
>
> > > [1] https://bugs.debian.org/972459 linux: Reenable CONFIG_IMA
>
> > I wasn't aware that because of lockdown, IMA was disabled. Thank you
> > for reporting and updating the IMA w/lockdown status.
> Feel free to comment it, please. It'd be nice to have IMA in Debian (not sure
> about Ubuntu status).
I can help with the Ubuntu status. IMA is still enabled there. You can
see CONFIG_IMA set to 'y' in the 20.04 LTS (Focal) and most recent 20.10
release (Groovy):
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/tree/debian.master/config/annotations#n12861
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/groovy/tree/debian.master/config/annotations#n13173
Tyler
>
> @Dmitry: do you plan to update Debian package? (you're the listed maintainer,
> although the package was signed by Wartan Hachaturow).
>
> > Mimi
>
> Kind regards,
> Petr
next prev parent reply other threads:[~2020-10-27 18:50 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-19 20:08 [PATCH ima-evm-utils] boot_aggregate.test: Skip if CONFIG_IMA not enabled Petr Vorel
2020-10-19 23:10 ` Mimi Zohar
2020-10-20 18:02 ` Petr Vorel
2020-10-27 16:06 ` Mimi Zohar
2020-10-27 18:51 ` Mikhail Novosyolov
2020-10-27 19:06 ` Mimi Zohar
2020-10-27 19:29 ` Mikhail Novosyolov
2020-10-27 20:01 ` Petr Vorel
2020-10-27 18:49 ` Tyler Hicks [this message]
2020-10-27 18:57 ` Mikhail Novosyolov
2020-10-23 12:46 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201027184933.GA5210@sequoia \
--to=tyhicks@linux.microsoft.com \
--cc=dbaryshkov@gmail.com \
--cc=linux-integrity@vger.kernel.org \
--cc=petr.vorel@gmail.com \
--cc=zohar@linux.ibm.com \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.