summaryrefslogtreecommitdiff
path: root/Documentation/security
diff options
context:
space:
mode:
authorRoberto Sassu <roberto.sassu@huawei.com>2021-06-03 15:17:05 +0200
committerMimi Zohar <zohar@linux.ibm.com>2021-06-03 10:02:37 -0400
commit88016de3ab075790e1f1bf047576e9b557c22d19 (patch)
treea524078fa7c6266bc65081f4882217f996b7bc70 /Documentation/security
parent8314b6732ae4e600bb933e108f96ce0176acb09c (diff)
downloadlwn-88016de3ab075790e1f1bf047576e9b557c22d19.tar.gz
lwn-88016de3ab075790e1f1bf047576e9b557c22d19.zip
ima: Define new template evm-sig
With the recent introduction of the evmsig template field, remote verifiers can obtain the EVM portable signature instead of the IMA signature, to verify file metadata. After introducing the new fields to include file metadata in the measurement list, this patch finally defines the evm-sig template, whose format is: d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode xattrnames, xattrlengths and xattrvalues are populated only from defined EVM protected xattrs, i.e. the ones that EVM considers to verify the portable signature. xattrnames and xattrlengths are populated only if the xattr is present. xattrnames and xattrlengths are not necessary for verifying the EVM portable signature, but they are included for completeness of information, if a remote verifier wants to infer more from file metadata. Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'Documentation/security')
-rw-r--r--Documentation/security/IMA-templates.rst1
1 files changed, 1 insertions, 0 deletions
diff --git a/Documentation/security/IMA-templates.rst b/Documentation/security/IMA-templates.rst
index 6a58760a0a35..5adc22f99496 100644
--- a/Documentation/security/IMA-templates.rst
+++ b/Documentation/security/IMA-templates.rst
@@ -91,6 +91,7 @@ Below, there is the list of defined template descriptors:
- "ima-sig": its format is ``d-ng|n-ng|sig``;
- "ima-buf": its format is ``d-ng|n-ng|buf``;
- "ima-modsig": its format is ``d-ng|n-ng|sig|d-modsig|modsig``;
+ - "evm-sig": its format is ``d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode``;
Use