Messages in this thread | | | Subject | Re: [PATCH 2/2] ima: Support appraise_type=imasig_optional | From | Mimi Zohar <> | Date | Wed, 13 Feb 2013 09:03:39 -0500 |
| |
On Wed, 2013-02-13 at 15:36 +0200, Kasatkin, Dmitry wrote: > It should not be the only line in the policy. > Can you share full policy?
> On Wed, Feb 13, 2013 at 3:29 PM, Vivek Goyal <vgoyal@redhat.com> wrote: > > > > appraise fowner=0 func=BPRM_CHECK appraise_type=imasig_optional
Different use cases require different policies. Our concern is that appraising file integrity not be added to the kernel in an ad-hoc manner.
This rule implements the intent of the original patches Vivek posted. We might personally disagree with the intent, but that is a totally separate discussion - one that should have been raised when he posted the original patches.
thanks,
Mimi
| |