From: Stefan Berger <stefanb@linux.vnet.ibm.com>
To: initramfs@vger.kernel.org, harald@redhat.com
Cc: linux-ima-user@lists.sourceforge.net,
systemd-devel@lists.freedesktop.org,
Stefan Berger <stefanb@us.ibm.com>
Subject: [PATCH v2] 98integrity: Use /etc/ima as dir for IMA policy and config file
Date: Wed, 30 Nov 2016 10:10:34 -0500 [thread overview]
Message-ID: <1480518634-31897-1-git-send-email-stefanb@linux.vnet.ibm.com> (raw)
From: Stefan Berger <stefanb@us.ibm.com>
To sync with systemd, use the filepath /etc/ima/ima-policy as
the file location for the IMA policy. At the same time we
move the ima config file location to /etc/ima/ima. Adapt the
documentation to the new path.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
---
modules.d/98integrity/README | 8 ++++----
modules.d/98integrity/ima-keys-load.sh | 2 +-
modules.d/98integrity/ima-policy-load.sh | 9 +++++++--
3 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/modules.d/98integrity/README b/modules.d/98integrity/README
index 64de0ae..c8ccee5 100644
--- a/modules.d/98integrity/README
+++ b/modules.d/98integrity/README
@@ -33,10 +33,10 @@ line.
# Save the policy in a file.
-# Create the configuration file '/etc/sysconfig/ima' to override the path name of
+# Create the configuration file '/etc/ima/ima' to override the path name of
# the IMA custom policy.
-------------- '/etc/sysconfig/ima' (with the default value) -------------
-IMAPOLICY="/etc/sysconfig/ima-policy"
+------------- '/etc/ima/ima' (with the default value) -------------
+IMAPOLICY="/etc/ima/ima-policy"
-------------------------------------------------------------------------
@@ -64,5 +64,5 @@ IMAPOLICY="/etc/sysconfig/ima-policy"
# 98integrity/ima-keys-load.sh script loads the signed certificates stored
# in the $IMAKEYSDIR onto the trusted IMA keyring. The default $IMAKEYSDIR
-# directory is /etc/keys/ima, but can be specified in the /etc/sysconfig/ima
+# directory is /etc/keys/ima, but can be specified in the /etc/ima/ima
# policy.
diff --git a/modules.d/98integrity/ima-keys-load.sh b/modules.d/98integrity/ima-keys-load.sh
index 659b722..6c6db40 100755
--- a/modules.d/98integrity/ima-keys-load.sh
+++ b/modules.d/98integrity/ima-keys-load.sh
@@ -2,7 +2,7 @@
SECURITYFSDIR="/sys/kernel/security"
IMASECDIR="${SECURITYFSDIR}/ima"
-IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
+IMACONFIG="${NEWROOT}/etc/ima/ima"
load_x509_keys()
{
diff --git a/modules.d/98integrity/ima-policy-load.sh b/modules.d/98integrity/ima-policy-load.sh
index 85cd3b9..4cd6ba3 100755
--- a/modules.d/98integrity/ima-policy-load.sh
+++ b/modules.d/98integrity/ima-policy-load.sh
@@ -5,10 +5,15 @@
# Copyright (C) 2011 Politecnico di Torino, Italy
# TORSEC group -- http://security.polito.it
# Roberto Sassu <roberto.sassu@polito.it>
+#
+# Copyright (C) 2016 IBM Corporation
+#
+# Stefan Berger <stefanb@linux.vnet.ibm.com>
+#
IMASECDIR="${SECURITYFSDIR}/ima"
-IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
-IMAPOLICY="/etc/sysconfig/ima-policy"
+IMACONFIG="${NEWROOT}/etc/ima/ima"
+IMAPOLICY="/etc/ima/ima-policy"
load_ima_policy()
{
--
2.8.3
_______________________________________________
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel
next reply other threads:[~2016-11-30 15:10 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-30 15:10 Stefan Berger [this message]
[not found] ` <1480518634-31897-1-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2016-11-30 15:16 ` [PATCH v2] 98integrity: Use /etc/ima as dir for IMA policy and config file Harald Hoyer
[not found] ` <5526de6b-c774-f94b-30ce-065e03d28ce3-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2016-11-30 15:24 ` Stefan Berger
2016-11-30 15:52 ` Harald Hoyer
2016-11-30 16:03 ` Stefan Berger
2016-11-30 16:04 ` Dracut GitHub Import Bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1480518634-31897-1-git-send-email-stefanb@linux.vnet.ibm.com \
--to=stefanb@linux.vnet.ibm.com \
--cc=harald@redhat.com \
--cc=initramfs@vger.kernel.org \
--cc=linux-ima-user@lists.sourceforge.net \
--cc=stefanb@us.ibm.com \
--cc=systemd-devel@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).