From: Bruno Meneguele <[email protected]> redhat/configs: disable {IMA,EVM}_LOAD_X509
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977529 This option was enabled by mistake (from my own part): this is only used for allowing the option {IMA,EVM}_X509_PATH to be set with a specific path in the system pointing to a valid X509 certificate, specific built for the integrity subsystem. It turns out that we don't have such certificate and am not sure it's going to be used anytime soon. In RHEL-8 we've allowed trusted certificates to the integrity subsystem using the secure boot CA and the certs used for the kernel build. With these options set we have the following two error lines in dmesg: integrity: Unable to open file: /etc/keys/x509_ima.der (-2) integrity: Unable to open file: /etc/keys/x509_evm.der (-2) Signed-off-by: Bruno Meneguele <[email protected]> diff --git a/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509 b/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509 deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509 +++ /dev/null @@ -1 +0,0 @@ -CONFIG_EVM_LOAD_X509=y diff --git a/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509 b/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509 deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509 +++ /dev/null @@ -1 +0,0 @@ -CONFIG_IMA_LOAD_X509=y diff --git a/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH b/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH +++ /dev/null @@ -1 +0,0 @@ -CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der" -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1234 _______________________________________________ kernel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
