* [PATCH] ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
@ 2023-09-21 6:45 Oleksandr Tymoshenko
2023-09-26 4:20 ` Oleksandr Tymoshenko
2023-09-26 21:32 ` Nayna
0 siblings, 2 replies; 4+ messages in thread
From: Oleksandr Tymoshenko @ 2023-09-21 6:45 UTC (permalink / raw)
To: Mimi Zohar, Dmitry Kasatkin, Paul Moore, James Morris,
Serge E. Hallyn, Nayna Jain
Cc: ovt, rnv, linux-integrity, linux-security-module, linux-kernel
The removal of IMA_TRUSTED_KEYRING made IMA_LOAD_X509
and IMA_BLACKLIST_KEYRING unavailable because the latter
two depend on the former. Since IMA_TRUSTED_KEYRING was
deprecated in favor of INTEGRITY_TRUSTED_KEYRING use it
as a dependency for the two Kconfigs affected by the
deprecation.
Fixes: 5087fd9e80e5 ("ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig")
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
---
security/integrity/ima/Kconfig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index ecddc807c536..4e559bd1fd41 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -269,7 +269,7 @@ config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
config IMA_BLACKLIST_KEYRING
bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)"
depends on SYSTEM_TRUSTED_KEYRING
- depends on IMA_TRUSTED_KEYRING
+ depends on INTEGRITY_TRUSTED_KEYRING
default n
help
This option creates an IMA blacklist keyring, which contains all
@@ -279,7 +279,7 @@ config IMA_BLACKLIST_KEYRING
config IMA_LOAD_X509
bool "Load X509 certificate onto the '.ima' trusted keyring"
- depends on IMA_TRUSTED_KEYRING
+ depends on INTEGRITY_TRUSTED_KEYRING
default n
help
File signature verification is based on the public keys
--
2.42.0.459.ge4e396fd5e-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
2023-09-21 6:45 [PATCH] ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig Oleksandr Tymoshenko
@ 2023-09-26 4:20 ` Oleksandr Tymoshenko
2023-09-27 10:44 ` Mimi Zohar
2023-09-26 21:32 ` Nayna
1 sibling, 1 reply; 4+ messages in thread
From: Oleksandr Tymoshenko @ 2023-09-26 4:20 UTC (permalink / raw)
To: Mimi Zohar, Dmitry Kasatkin, Paul Moore, James Morris,
Serge E. Hallyn, Nayna Jain
Cc: rnv, linux-integrity, linux-security-module, linux-kernel
On Wed, Sep 20, 2023 at 11:45 PM Oleksandr Tymoshenko <ovt@google.com> wrote:
>
> The removal of IMA_TRUSTED_KEYRING made IMA_LOAD_X509
> and IMA_BLACKLIST_KEYRING unavailable because the latter
> two depend on the former. Since IMA_TRUSTED_KEYRING was
> deprecated in favor of INTEGRITY_TRUSTED_KEYRING use it
> as a dependency for the two Kconfigs affected by the
> deprecation.
>
> Fixes: 5087fd9e80e5 ("ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig")
> Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
Gentle ping, IMA_LOAD_X509 and IMA_BLACKLIST_KEYRING options are
currently broken on all branches.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
2023-09-26 4:20 ` Oleksandr Tymoshenko
@ 2023-09-27 10:44 ` Mimi Zohar
0 siblings, 0 replies; 4+ messages in thread
From: Mimi Zohar @ 2023-09-27 10:44 UTC (permalink / raw)
To: Oleksandr Tymoshenko, Dmitry Kasatkin, Paul Moore, James Morris,
Serge E. Hallyn, Nayna Jain
Cc: rnv, linux-integrity, linux-security-module, linux-kernel
On Mon, 2023-09-25 at 21:20 -0700, Oleksandr Tymoshenko wrote:
> On Wed, Sep 20, 2023 at 11:45 PM Oleksandr Tymoshenko <ovt@google.com> wrote:
> >
> > The removal of IMA_TRUSTED_KEYRING made IMA_LOAD_X509
> > and IMA_BLACKLIST_KEYRING unavailable because the latter
> > two depend on the former. Since IMA_TRUSTED_KEYRING was
> > deprecated in favor of INTEGRITY_TRUSTED_KEYRING use it
> > as a dependency for the two Kconfigs affected by the
> > deprecation.
> >
> > Fixes: 5087fd9e80e5 ("ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig")
> > Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
>
> Gentle ping, IMA_LOAD_X509 and IMA_BLACKLIST_KEYRING options are
> currently broken on all branches.
Sorry for the delay. It's now in linux-next.
--
thanks,
Mimi
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
2023-09-21 6:45 [PATCH] ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig Oleksandr Tymoshenko
2023-09-26 4:20 ` Oleksandr Tymoshenko
@ 2023-09-26 21:32 ` Nayna
1 sibling, 0 replies; 4+ messages in thread
From: Nayna @ 2023-09-26 21:32 UTC (permalink / raw)
To: Oleksandr Tymoshenko, Mimi Zohar
Cc: rnv, linux-integrity, linux-security-module, linux-kernel,
Dmitry Kasatkin, James Morris, Serge E. Hallyn, Nayna Jain,
Paul Moore
On 9/21/23 02:45, Oleksandr Tymoshenko wrote:
> The removal of IMA_TRUSTED_KEYRING made IMA_LOAD_X509
> and IMA_BLACKLIST_KEYRING unavailable because the latter
> two depend on the former. Since IMA_TRUSTED_KEYRING was
> deprecated in favor of INTEGRITY_TRUSTED_KEYRING use it
> as a dependency for the two Kconfigs affected by the
> deprecation.
>
> Fixes: 5087fd9e80e5 ("ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig")
> Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
Thanks for doing this.
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-09-27 10:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-21 6:45 [PATCH] ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig Oleksandr Tymoshenko
2023-09-26 4:20 ` Oleksandr Tymoshenko
2023-09-27 10:44 ` Mimi Zohar
2023-09-26 21:32 ` Nayna
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).