From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752989AbcDFSvQ (ORCPT ); Wed, 6 Apr 2016 14:51:16 -0400 Received: from e28smtp01.in.ibm.com ([125.16.236.1]:34950 "EHLO e28smtp01.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752058AbcDFSvN (ORCPT ); Wed, 6 Apr 2016 14:51:13 -0400 X-IBM-Helo: d28relay05.in.ibm.com X-IBM-MailFrom: zohar@linux.vnet.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org;keyrings@vger.kernel.org;linux-security-module@vger.kernel.org Message-ID: <1459968654.3166.39.camel@linux.vnet.ibm.com> Subject: Re: [PATCH] IMA: Use the system trusted keyrings instead of .ima_mok (update) From: Mimi Zohar To: David Howells Cc: linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 06 Apr 2016 14:50:54 -0400 In-Reply-To: <10434.1459966209@warthog.procyon.org.uk> References: <1459962349.3166.25.camel@linux.vnet.ibm.com> <1459911605.3166.13.camel@linux.vnet.ibm.com> <4392.1459959890@warthog.procyon.org.uk> <10434.1459966209@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable x-cbid: 16040618-4790-0000-0000-00000EAD6A32 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 2016-04-06 at 19:10 +0100, David Howells wrote: > Mimi Zohar wrote: > > > I'm not sure what you're asking. If you're asking if the whole file can > > be include based on whether this option is enabled, then no. > > No - but integrity_init_keyring() just returns if init_keyring is false - but > this is a variable and is assigned storage, despite the fact that its value is > only set at compile time as far as I can see. Originally userspace created the original IMA and EVM keyrings, while the dot prefixed trusted keyrings were created by the kernel. The kernel could just as well create the original underscore prefixed IMA and EVM keyrings. Mimi