Skip to content

Commit

Permalink
IMA: update IMA policy documentation to include pcr= option
Browse files Browse the repository at this point in the history
Commit 0260643 "ima: add policy support for extending different pcrs"
introduced a new IMA policy option "pcr=".  Missing was the documentation
for this option.  This patch updates ima_policy to include this option,
as well as an example.

Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
  • Loading branch information
Eric Richter authored and Mimi Zohar committed Jun 21, 2017
1 parent 915d9d2 commit fc26bd5
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion Documentation/ABI/testing/ima_policy
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,10 @@ Description:
fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
uid:= decimal value
euid:= decimal value
fowner:=decimal value
fowner:= decimal value
lsm: are LSM specific
option: appraise_type:= [imasig]
pcr:= decimal value

default policy:
# PROC_SUPER_MAGIC
Expand Down Expand Up @@ -96,3 +97,8 @@ Description:

Smack:
measure subj_user=_ func=FILE_CHECK mask=MAY_READ

Example of measure rules using alternate PCRs:

measure func=KEXEC_KERNEL_CHECK pcr=4
measure func=KEXEC_INITRAMFS_CHECK pcr=5

0 comments on commit fc26bd5

Please sign in to comment.