diff options
Diffstat (limited to 'security/integrity')
| -rw-r--r-- | security/integrity/ima/Kconfig | 10 | ||||
| -rw-r--r-- | security/integrity/ima/ima_main.c | 4 |
2 files changed, 14 insertions, 0 deletions
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index f4d25e045808..b3a9f86809b0 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -347,4 +347,14 @@ config IMA_STAGING On kexec, staging is aborted and any staged measurement records are copied to the secondary kernel. +config IMA_INIT_LATE_SYNC + bool "Initialise IMA at late_initcall_sync" + default n + help + This option initialises IMA at late_initcall_sync for platforms + where TPM device probing is deferred. + When this option is enabled, modules that access files in the + initramfs through usermode helper calls such as request_module() + during initcall must not be built-in. Otherwise, IMA may miss + file measurements for them. endif diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index ff52becc3031..cfb08334fbe7 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -1376,5 +1376,9 @@ DEFINE_LSM(ima) = { .order = LSM_ORDER_LAST, .blobs = &ima_blob_sizes, /* Start IMA after the TPM is available */ +#ifndef CONFIG_IMA_INIT_LATE_SYNC .initcall_late = init_ima, +#else + .initcall_late_sync = init_ima, +#endif }; |