From: Bruno Meneguele on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1166
The config options being enable here are some that I missed in previous MRs that I opened re-working the IMA overall state across all ARK supported arches.
All options were already enabled in one or more arches in RHEL-8, so enabling it in ARK are safe.
Signed-off-by: Bruno Meneguele bmeneg@redhat.com
c30e184b2b98 (Bruno Meneguele) redhat/configs: enable IMA_KEXEC for supported arches
aab410e1a8dc (Bruno Meneguele) redhat/configs: enable INTEGRITY_SIGNATURE to all arches
redhat/configs/ark/generic/CONFIG_IMA_KEXEC | 1 - redhat/configs/ark/generic/CONFIG_INTEGRITY_SIGNATURE | 1 - redhat/configs/ark/generic/x86/x86_64/CONFIG_IMA_APPRAISE_BUILD_POLICY | 1 - redhat/configs/ark/generic/x86/x86_64/CONFIG_INTEGRITY_SIGNATURE | 1 - .../generic/powerpc => common/generic}/CONFIG_IMA_APPRAISE_BUILD_POLICY | 0 redhat/configs/{fedora => common}/generic/CONFIG_IMA_KEXEC | 0 .../{ark/generic/powerpc => common/generic}/CONFIG_INTEGRITY_SIGNATURE | 0 redhat/configs/fedora/generic/CONFIG_IMA_APPRAISE_BUILD_POLICY | 1 - redhat/configs/fedora/generic/CONFIG_INTEGRITY_SIGNATURE | 1 - 9 files changed, 6 deletions(-)
From: Bruno Meneguele bmeneg@redhat.com
redhat/configs: enable INTEGRITY_SIGNATURE to all arches
CONFIG_INTEGRITY_SIGNATURE has been enabled for all supported arches in RHEL-8 and also in Fedora, but I missed it in ARK and, consequently, s390x missed the CONFIG_IMA_APPRAISE_MODSIG option, which should be set.
However, enabling as generic option also force we to generically disable CONFIG_IMA_APPRAISE_BUILD_POLICY, which is fine for now.
Signed-off-by: Bruno Meneguele bmeneg@redhat.com
diff --git a/redhat/configs/ark/generic/CONFIG_INTEGRITY_SIGNATURE b/redhat/configs/ark/generic/CONFIG_INTEGRITY_SIGNATURE deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_INTEGRITY_SIGNATURE +++ /dev/null @@ -1 +0,0 @@ -# CONFIG_INTEGRITY_SIGNATURE is not set diff --git a/redhat/configs/ark/generic/x86/x86_64/CONFIG_IMA_APPRAISE_BUILD_POLICY b/redhat/configs/ark/generic/x86/x86_64/CONFIG_IMA_APPRAISE_BUILD_POLICY deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/x86/x86_64/CONFIG_IMA_APPRAISE_BUILD_POLICY +++ /dev/null @@ -1 +0,0 @@ -# CONFIG_IMA_APPRAISE_BUILD_POLICY is not set diff --git a/redhat/configs/ark/generic/x86/x86_64/CONFIG_INTEGRITY_SIGNATURE b/redhat/configs/ark/generic/x86/x86_64/CONFIG_INTEGRITY_SIGNATURE deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/x86/x86_64/CONFIG_INTEGRITY_SIGNATURE +++ /dev/null @@ -1 +0,0 @@ -CONFIG_INTEGRITY_SIGNATURE=y diff --git a/redhat/configs/ark/generic/powerpc/CONFIG_IMA_APPRAISE_BUILD_POLICY b/redhat/configs/common/generic/CONFIG_IMA_APPRAISE_BUILD_POLICY rename from redhat/configs/ark/generic/powerpc/CONFIG_IMA_APPRAISE_BUILD_POLICY rename to redhat/configs/common/generic/CONFIG_IMA_APPRAISE_BUILD_POLICY index blahblah..blahblah 100644 --- a/redhat/configs/ark/generic/powerpc/CONFIG_IMA_APPRAISE_BUILD_POLICY +++ b/redhat/configs/common/generic/CONFIG_IMA_APPRAISE_BUILD_POLICY diff --git a/redhat/configs/ark/generic/powerpc/CONFIG_INTEGRITY_SIGNATURE b/redhat/configs/common/generic/CONFIG_INTEGRITY_SIGNATURE rename from redhat/configs/ark/generic/powerpc/CONFIG_INTEGRITY_SIGNATURE rename to redhat/configs/common/generic/CONFIG_INTEGRITY_SIGNATURE index blahblah..blahblah 100644 --- a/redhat/configs/ark/generic/powerpc/CONFIG_INTEGRITY_SIGNATURE +++ b/redhat/configs/common/generic/CONFIG_INTEGRITY_SIGNATURE diff --git a/redhat/configs/fedora/generic/CONFIG_IMA_APPRAISE_BUILD_POLICY b/redhat/configs/fedora/generic/CONFIG_IMA_APPRAISE_BUILD_POLICY deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/fedora/generic/CONFIG_IMA_APPRAISE_BUILD_POLICY +++ /dev/null @@ -1 +0,0 @@ -# CONFIG_IMA_APPRAISE_BUILD_POLICY is not set diff --git a/redhat/configs/fedora/generic/CONFIG_INTEGRITY_SIGNATURE b/redhat/configs/fedora/generic/CONFIG_INTEGRITY_SIGNATURE deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/fedora/generic/CONFIG_INTEGRITY_SIGNATURE +++ /dev/null @@ -1 +0,0 @@ -CONFIG_INTEGRITY_SIGNATURE=y
-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1166
From: Bruno Meneguele bmeneg@redhat.com
redhat/configs: enable IMA_KEXEC for supported arches
In RHEL-8, powerpc has support for IMA_KEXEC, and today, only ppc and aarch64 supports IMA_KEXEC, which are backed by the HAVE_IMA_KEXEC option. With that, lets enable it in ARK and also, since the HAVE_* option it's safe to enable the CONFIG_IMA_KEXEC option as a common/generic option too.
Signed-off-by: Bruno Meneguele bmeneg@redhat.com
diff --git a/redhat/configs/ark/generic/CONFIG_IMA_KEXEC b/redhat/configs/ark/generic/CONFIG_IMA_KEXEC deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_IMA_KEXEC +++ /dev/null @@ -1 +0,0 @@ -# CONFIG_IMA_KEXEC is not set diff --git a/redhat/configs/fedora/generic/CONFIG_IMA_KEXEC b/redhat/configs/common/generic/CONFIG_IMA_KEXEC rename from redhat/configs/fedora/generic/CONFIG_IMA_KEXEC rename to redhat/configs/common/generic/CONFIG_IMA_KEXEC index blahblah..blahblah 100644 --- a/redhat/configs/fedora/generic/CONFIG_IMA_KEXEC +++ b/redhat/configs/common/generic/CONFIG_IMA_KEXEC
-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1166
From: Bruno Meneguele on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1166#note_5931755...
cc @msalter:
CONFIG_IMA_KEXEC isn't enabled in RHEL-8 for aarch64, but should be safe to be enabled in ARK.
From: Jerry Snitselaar on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1166#note_5984019...
Acked-by: Jerry Snitselaar jsnitsel@redhat.com (via approve button)
From: Mark Salter on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1166#note_5985802...
Acked-by: Mark Salter msalter@redhat.com (via approve button)
kernel@lists.fedoraproject.org