From 80eae209d63ac6361c7b445f7e7e41f39c044772 Mon Sep 17 00:00:00 2001 From: Petko Manolov Date: Wed, 2 Dec 2015 17:47:56 +0200 Subject: IMA: allow reading back the current IMA policy It is often useful to be able to read back the IMA policy. It is even more important after introducing CONFIG_IMA_WRITE_POLICY. This option allows the root user to see the current policy rules. Signed-off-by: Zbigniew Jasinski Signed-off-by: Petko Manolov Signed-off-by: Mimi Zohar --- security/integrity/ima/Kconfig | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'security/integrity/ima/Kconfig') diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 8d5e6e0e0937..e54a8a8dae94 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -118,6 +118,16 @@ config IMA_WRITE_POLICY If unsure, say N. +config IMA_READ_POLICY + bool "Enable reading back the current IMA policy" + depends on IMA + default y if IMA_WRITE_POLICY + default n if !IMA_WRITE_POLICY + help + It is often useful to be able to read back the IMA policy. It is + even more important after introducing CONFIG_IMA_WRITE_POLICY. + This option allows the root user to see the current policy rules. + config IMA_APPRAISE bool "Appraise integrity measurements" depends on IMA -- cgit v1.2.3