diff options
| author | Roberto Sassu <roberto.sassu@polito.it> | 2012-03-15 19:06:11 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2012-03-22 00:20:58 +0100 |
| commit | 816115863962548a9a0d9fbfe429c7f8e685beac (patch) | |
| tree | 2751984a95d834da101c8cdb3d7da0df6871e5ea /src/main.c | |
| parent | 160481f68d0a5f26f75c04fb576fb854fd5416a5 (diff) | |
main: added support for loading IMA custom policies
This is an S/MIME signed message
The new function ima_setup() loads an IMA custom policy from a file in the
default location '/etc/ima/ima-policy', if present, and writes it to the
path 'ima/policy' in the security filesystem. This function is executed
at early stage in order to avoid that some file operations are not measured
by IMA and it is placed after the initialization of SELinux because IMA
needs the latter (or other security modules) to understand LSM-specific
rules. This feature is enabled by default and can be disabled by providing
the option '--disable-ima' to the configure script.
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Acked-by: Gianluca Ramunno <ramunno@polito.it>
Diffstat (limited to 'src/main.c')
| -rw-r--r-- | src/main.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/main.c b/src/main.c index ed317b4413..7ae88414a9 100644 --- a/src/main.c +++ b/src/main.c @@ -41,6 +41,7 @@ #include "kmod-setup.h" #include "locale-setup.h" #include "selinux-setup.h" +#include "ima-setup.h" #include "machine-id-setup.h" #include "load-fragment.h" #include "fdset.h" @@ -1203,9 +1204,12 @@ int main(int argc, char *argv[]) { arg_running_as = MANAGER_SYSTEM; log_set_target(detect_container(NULL) > 0 ? LOG_TARGET_CONSOLE : LOG_TARGET_JOURNAL_OR_KMSG); - if (!is_reexec) + if (!is_reexec) { if (selinux_setup(&loaded_policy) < 0) goto finish; + if (ima_setup() < 0) + goto finish; + } log_open(); |