summaryrefslogtreecommitdiff
path: root/src/main.c
diff options
context:
space:
mode:
authorRoberto Sassu <roberto.sassu@polito.it>2012-03-15 19:06:11 +0100
committerLennart Poettering <lennart@poettering.net>2012-03-22 00:20:58 +0100
commit816115863962548a9a0d9fbfe429c7f8e685beac (patch)
tree2751984a95d834da101c8cdb3d7da0df6871e5ea /src/main.c
parent160481f68d0a5f26f75c04fb576fb854fd5416a5 (diff)
main: added support for loading IMA custom policies
This is an S/MIME signed message The new function ima_setup() loads an IMA custom policy from a file in the default location '/etc/ima/ima-policy', if present, and writes it to the path 'ima/policy' in the security filesystem. This function is executed at early stage in order to avoid that some file operations are not measured by IMA and it is placed after the initialization of SELinux because IMA needs the latter (or other security modules) to understand LSM-specific rules. This feature is enabled by default and can be disabled by providing the option '--disable-ima' to the configure script. Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Acked-by: Gianluca Ramunno <ramunno@polito.it>
Diffstat (limited to 'src/main.c')
-rw-r--r--src/main.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/main.c b/src/main.c
index ed317b4413..7ae88414a9 100644
--- a/src/main.c
+++ b/src/main.c
@@ -41,6 +41,7 @@
#include "kmod-setup.h"
#include "locale-setup.h"
#include "selinux-setup.h"
+#include "ima-setup.h"
#include "machine-id-setup.h"
#include "load-fragment.h"
#include "fdset.h"
@@ -1203,9 +1204,12 @@ int main(int argc, char *argv[]) {
arg_running_as = MANAGER_SYSTEM;
log_set_target(detect_container(NULL) > 0 ? LOG_TARGET_CONSOLE : LOG_TARGET_JOURNAL_OR_KMSG);
- if (!is_reexec)
+ if (!is_reexec) {
if (selinux_setup(&loaded_policy) < 0)
goto finish;
+ if (ima_setup() < 0)
+ goto finish;
+ }
log_open();