Re: [PATCH v2 2/3] integrity: move integrity subsystem options to a separate menu

[Dmitry Kasatkin <d.kasatkin@samsung.com>]

On 03/09/14 15:35, Mimi Zohar wrote:
> On Wed, 2014-09-03 at 10:29 +0300, Dmitry Kasatkin wrote: 
>> Integrity subsystem got lots of options and takes more than half
>> of security menu.
>>
>> This patch moves integrity subsystem options to a separate menu.
>> It does not affect existing configuration. Re-configuration is
>> not needed.
>>
>> Changes in v2:
>> - previous patch moved integrity out of the 'security' menu.
>>   This version keeps integrity as a security option (Mimi).
>>
>> Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
>> ---
>>  security/integrity/Kconfig     | 14 ++++++++++++--
>>  security/integrity/evm/Kconfig |  9 +--------
>>  security/integrity/ima/Kconfig |  3 +--
>>  3 files changed, 14 insertions(+), 12 deletions(-)
>>
>> diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
>> index f79d853..a734a83 100644
>> --- a/security/integrity/Kconfig
>> +++ b/security/integrity/Kconfig
>> @@ -1,7 +1,13 @@
>>  #
>>  config INTEGRITY
>> -	def_bool y
>> -	depends on IMA || EVM
>> +	bool "Integrity subsystem support"
>> +	depends on SECURITY
>> +	default y
>> +
>> +if INTEGRITY
>> +
>> +menu "Options"
>> +
> Instead of moving everything to a separate menu, I would leave the
> ability to enable/disable IMA and EVM on the security page, but move
> their options to separate pages.  So unless someone wants to change the
> default options, they're hidden.
>
> There are Kconfig examples for enabling the option in the parent
> directory and clicking on the option brings up a separate menu (eg. NET,
> WIRELESS).

Actually it is better to have as separate menu, because there are
integrity level specific options there as auditing or digital
signatures. It is nice to have them all in one place.

>>  config INTEGRITY_SIGNATURE
>>  	boolean "Digital signature verification using multiple keyrings"
>> @@ -46,3 +52,7 @@ config INTEGRITY_AUDIT
>>
>>  source security/integrity/ima/Kconfig
>>  source security/integrity/evm/Kconfig
>> +
>> +endmenu
>> +
>> +endif   # if INTEGRITY
>> diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig
>> index d606f3d..df20a2f 100644
>> --- a/security/integrity/evm/Kconfig
>> +++ b/security/integrity/evm/Kconfig
>> @@ -1,6 +1,6 @@
>>  config EVM
>>  	boolean "EVM support"
>> -	depends on SECURITY
>> +	depends on INTEGRITY
> By adding the "if INTEGRITY",  the "depends on INTEGRITY" is redundant.
> Please remove the depends here and in the other places.

Will do.

- Dmitry
> Mimi
>
>>  	select KEYS
>>  	select ENCRYPTED_KEYS
>>  	select CRYPTO_HMAC
>> @@ -12,10 +12,6 @@ config EVM
>>
>>  	  If you are unsure how to answer this question, answer N.
>>
>> -if EVM
>> -
>> -menu "EVM options"
>> -
>>  config EVM_ATTR_FSUUID
>>  	bool "FSUUID (version 2)"
>>  	default y
>> @@ -47,6 +43,3 @@ config EVM_EXTRA_SMACK_XATTRS
>>  	  additional info to the calculation, requires existing EVM
>>  	  labeled file systems to be relabeled.
>>
>> -endmenu
>> -
>> -endif
>> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
>> index 08758fb..2477d1e 100644
>> --- a/security/integrity/ima/Kconfig
>> +++ b/security/integrity/ima/Kconfig
>> @@ -2,8 +2,7 @@
>>  #
>>  config IMA
>>  	bool "Integrity Measurement Architecture(IMA)"
>> -	depends on SECURITY
>> -	select INTEGRITY
>> +	depends on INTEGRITY
>>  	select SECURITYFS
>>  	select CRYPTO
>>  	select CRYPTO_HMAC
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>