| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
IMA: Introduce a config to bypass i_version detection for Overlayfs issue hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9V12H CVE: NA -------------------------------- IMA detect the backing inode changes through i_version of the backing inode would introduce a performance degrade, so introduce a config to allow users to bypass the i_version detection or not. Signed-off-by: GUO Zihua <guozihua@huawei.com> Signed-off-by: Xiang Yang <xiangyang3@huawei.com> | 2 年前 | |
ima: Rename ima_cvm to ima_virtcca hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- VirtCCA is the name of device that IMA works with, while CVM, standing for Confidential Virtual Machine, is what IMA will achieve, together with VirtCCA as well as other components. So naming those file/function with ima_virtcca makes more sense. Co-developed-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: rot: Make RoT kick in hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- Now the RoT framework starts working, by replacing ima_tpm_chip and those relavant function calls to their RoT counterparts. Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: rot: Make RoT kick in hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- Now the RoT framework starts working, by replacing ima_tpm_chip and those relavant function calls to their RoT counterparts. Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr stable inclusion from stable-v6.6.117 commit d2993a7e98eb70c737c6f5365a190e79c72b8407 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11626 CVE: CVE-2025-68183 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2993a7e98eb70c737c6f5365a190e79c72b8407 -------------------------------- [ Upstream commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd ] Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL, #include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdlib.h> int main() { const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd; fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror("Error opening file"); return 1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); } if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } close(fd); return 0; } Signed-off-by: Coiby Xu <coxu@redhat.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zhao Yipeng <zhaoyipeng5@huawei.com> | 5 个月前 | |
fs: port xattr to mnt_idmap Convert to struct mnt_idmap. Last cycle we merged the necessary infrastructure in 256c8aed2b42 ("fs: introduce dedicated idmap type for mounts"). This is just the conversion to struct mnt_idmap. Currently we still pass around the plain namespace that was attached to a mount. This is in general pretty convenient but it makes it easy to conflate namespaces that are relevant on the filesystem with namespaces that are relevent on the mount level. Especially for non-vfs developers without detailed knowledge in this area this can be a potential source for bugs. Once the conversion to struct mnt_idmap is done all helpers down to the really low-level helpers will take a struct mnt_idmap argument instead of two namespace arguments. This way it becomes impossible to conflate the two eliminating the possibility of any bugs. All of the vfs and all filesystems only operate on struct mnt_idmap. Acked-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> | 3 年前 | |
ima: check return value of crypto_shash_final() in boot aggregate stable inclusion from stable-v6.6.141 commit 5dcb51558e781d6066b3125b07a58c6971581cce category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5dcb51558e781d6066b3125b07a58c6971581cce -------------------------------- commit 5dcb51558e781d6066b3125b07a58c6971581cce upstream. [ Upstream commit 870819434c8dfcc3158033b66e7851b81bb17e21 ] The return value of crypto_shash_final() is not checked in ima_calc_boot_aggregate_tfm(). If the hash finalization fails, the function returns success and a corrupted boot aggregate digest could be used for IMA measurements. Capture the return value and propagate any error to the caller. Fixes: 76bb28f6126f ("ima: use new crypto_shash API instead of old crypto_hash") Signed-off-by: Daniel Hodges <hodgesd@meta.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Wang Hai <wanghai38@huawei.com> | 1 个月前 | |
IMA: Fix hungtask issue of digestlist importing EulerOS inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6364 -------------------------------- In the function ima_check_measured_appraised, if the digest list is not measured or appraised, the function returns without releasing the lock iint->mutex. Fixes: a513be25b661 ("ima: dont disable digest_list if the file is not processed") Signed-off-by: xuce <xuce10@h-partners.com> | 1 年前 | |
ima: dont disable digest_list if the file is not processed EulerOS inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IAIO9Q ------------------------------ In the previous implementation, if the digest list file is not measured or appraised, the whole IMA digest list function will be disabled, and the system must be rebooted. It is too strict because users may make some mistakes. This commit optimizes the processing logic. If the digest list file is not processed correctly, just deny access to the file without disabling the entire function. Signed-off-by: Huaxin Lu <luhuaxin1@huawei.com> | 1 年前 | |
ima: don't allow control characters in policy path euleros inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I91FSN CVE: NA ----------------------------------------------------------------- Expected error message ima: Unable to open file: can be overwritten when the uploaded path contains control characters like \r or \b. Therefore, When an invalid path (which contains control characters) is uploaded through SecurityFS, unexpected logs can be printed to dmesg. This patch rejects policy paths with control characters. Signed-off-by: Zhang Tianxing <zhangtianxing3@huawei.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com> Signed-off-by: zhoushuiqing <zhoushuiqing2@huawei.com> Signed-off-by: zhangguangzhi <zhangguangzhi3@huawei.com> | 2 年前 | |
ima: dont disable digest_list if the file is not processed EulerOS inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IAIO9Q ------------------------------ In the previous implementation, if the digest list file is not measured or appraised, the whole IMA digest list function will be disabled, and the system must be rebooted. It is too strict because users may make some mistakes. This commit optimizes the processing logic. If the digest list file is not processed correctly, just deny access to the file without disabling the entire function. Signed-off-by: Huaxin Lu <luhuaxin1@huawei.com> | 1 年前 | |
ima: rot: Adapt VirtCCA into Rot hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- VirtCCA is now fit into the RoT framework, with a lower priority against TPM, which means that the framework will always try to initialize and use TPM first. Nevertheless, users can select VirtCCA to be the IMA RoT with ima_rot=virtcca cmdline. Co-developed-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: verify the previous kernel's IMA buffer lies in addressable RAM stable inclusion from stable-v6.19.6 commit 5366ec7d2f793ce703c403d7fd4c25a3db365b9d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14784 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5366ec7d2f793ce703c403d7fd4c25a3db365b9d -------------------------------- [ Upstream commit 10d1c75ed4382a8e79874379caa2ead8952734f9 ] Patch series "Address page fault in ima_restore_measurement_list()", v3. When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>" we observe a pafe fault that happens. BUG: unable to handle page fault for address: ffff97793ff47000 RIP: ima_restore_measurement_list+0xdc/0x45a #PF: error_code(0x0000) not-present page This happens on x86_64 only, as this is already fixed in aarch64 in commit: cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") This patch (of 3): When the second-stage kernel is booted with a limiting command line (e.g. "mem=<size>"), the IMA measurement buffer handed over from the previous kernel may fall outside the addressable RAM of the new kernel. Accessing such a buffer can fault during early restore. Introduce a small generic helper, ima_validate_range(), which verifies that a physical [start, end] range for the previous-kernel IMA buffer lies within addressable memory: - On x86, use pfn_range_is_mapped(). - On OF based architectures, use page_is_ram(). Link: https://lkml.kernel.org/r/20251231061609.907170-1-harshit.m.mogalapalli@oracle.com Link: https://lkml.kernel.org/r/20251231061609.907170-2-harshit.m.mogalapalli@oracle.com Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Cc: Alexander Graf <graf@amazon.com> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Borislav Betkov <bp@alien8.de> Cc: guoweikang <guoweikang.kernel@gmail.com> Cc: Henry Willard <henry.willard@oracle.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jiri Bohac <jbohac@suse.cz> Cc: Joel Granados <joel.granados@kernel.org> Cc: Jonathan McDowell <noodles@fb.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Paul Webb <paul.x.webb@oracle.com> Cc: Sohil Mehta <sohil.mehta@intel.com> Cc: Sourabh Jain <sourabhjain@linux.ibm.com> Cc: Thomas Gleinxer <tglx@linutronix.de> Cc: Yifei Liu <yifei.l.liu@oracle.com> Cc: Baoquan He <bhe@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: security/integrity/ima/ima_kexec.c [fix context conflicts] Signed-off-by: Lin Yujun <linyujun809@h-partners.com> Signed-off-by: Liu Mingrui <liumingrui@huawei.com> | 1 个月前 | |
ima: process_measurement() needlessly takes inode_lock() on MAY_READ stable inclusion from stable-v6.6.93 commit 722a6972defd8a712cd37450639fcfd88f416b72 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8365 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=722a6972defd8a712cd37450639fcfd88f416b72 -------------------------------- [ Upstream commit 30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2 ] On IMA policy update, if a measure rule exists in the policy, IMA_MEASURE is set for ima_policy_flags which makes the violation_check variable always true. Coupled with a no-action on MAY_READ for a FILE_CHECK call, we're always taking the inode_lock(). This becomes a performance problem for extremely heavy read-only workloads. Therefore, prevent this only in the case there's no action to be taken. Signed-off-by: Frederick Lawler <fred@cloudflare.com> Acked-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 722a6972defd8a712cd37450639fcfd88f416b72) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> | 5 个月前 | |
ima: Support modsig verify using trusted keys euleros inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I99VV3 CVE: NA ----------------------------------------- Now the ima keyring is only allowed loading the end certificate because of the restriction restrict_link_by_digsig(). However, the period of validity of end certificates is usually short and cannot meet the lifecycle requirements of the LTS distribution. This commit modifies the verification process of modsig used by the IMA digest list feature. When the verification with the IMA keyring is failed, a further verification with the trusted keyring is attempted. Signed-off-by: Huaxin Lu <luhuaxin1@huawei.com> | 2 年前 | |
IMA: remove -Wmissing-prototypes warning With W=1 build, the compiler throws warning message as below: security/integrity/ima/ima_mok.c:24:12: warning: no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes] __init int ima_mok_init(void) Silence the warning by adding static keyword to ima_mok_init(). Signed-off-by: Austin Kim <austin.kim@lge.com> Fixes: 41c89b64d718 ("IMA: create machine owner and blacklist keyrings") Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> | 4 年前 | |
ima: Handle error code returned by ima_filter_rule_match() mainline inclusion from mainline-v6.19-rc1 commit 738c9738e690f5cea24a3ad6fd2d9a323cf614f6 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7810 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=738c9738e690f5cea24a3ad6fd2d9a323cf614f6 -------------------------------- In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if (!rc)' check and sets 'result = true'. The LSM rule is considered a match, causing extra files to be measured by IMA. This issue can be reproduced in the following scenario: After unloading the SELinux policy module via 'semodule -d', if an IMA measurement is triggered before ima_lsm_rules is updated, in ima_match_rules(), the first call to ima_filter_rule_match() returns -ESTALE. This causes the code to enter the 'if (rc == -ESTALE && !rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In ima_lsm_copy_rule(), since the SELinux module has been removed, the rule becomes NULL, and the second call to ima_filter_rule_match() returns -ENOENT. This bypasses the 'if (!rc)' check and results in a false match. Call trace: selinux_audit_rule_match+0x310/0x3b8 security_audit_rule_match+0x60/0xa0 ima_match_rules+0x2e4/0x4a0 ima_match_policy+0x9c/0x1e8 ima_get_action+0x48/0x60 process_measurement+0xf8/0xa98 ima_bprm_check+0x98/0xd8 security_bprm_check+0x5c/0x78 search_binary_handler+0x6c/0x318 exec_binprm+0x58/0x1b8 bprm_execve+0xb8/0x130 do_execveat_common.isra.0+0x1a8/0x258 __arm64_sys_execve+0x48/0x68 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x200 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error codes like -ENOENT do not bypass the check and accidentally result in a successful match. Fixes: 4af4662fa4a9d ("integrity: IMA policy") Signed-off-by: Zhao Yipeng <zhaoyipeng5@huawei.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Zhao Yipeng <zhaoyipeng5@huawei.com> | 6 个月前 | |
ima: rot: Adapt VirtCCA into Rot hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- VirtCCA is now fit into the RoT framework, with a lower priority against TPM, which means that the framework will always try to initialize and use TPM first. Nevertheless, users can select VirtCCA to be the IMA RoT with ima_rot=virtcca cmdline. Co-developed-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
fs: port xattr to mnt_idmap Convert to struct mnt_idmap. Last cycle we merged the necessary infrastructure in 256c8aed2b42 ("fs: introduce dedicated idmap type for mounts"). This is just the conversion to struct mnt_idmap. Currently we still pass around the plain namespace that was attached to a mount. This is in general pretty convenient but it makes it easy to conflate namespaces that are relevant on the filesystem with namespaces that are relevent on the mount level. Especially for non-vfs developers without detailed knowledge in this area this can be a potential source for bugs. Once the conversion to struct mnt_idmap is done all helpers down to the really low-level helpers will take a struct mnt_idmap argument instead of two namespace arguments. This way it becomes impossible to conflate the two eliminating the possibility of any bugs. All of the vfs and all filesystems only operate on struct mnt_idmap. Acked-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> | 3 年前 | |
ima: rot: remove misguiding message printing hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB5YWN CVE: NA -------------------------------- Remove the ".. failed to self-initialize" printing following the failure of an RoT candidate's initialization, as it may raise unnessary concerns from users, who may be misguided and think this message indicates some sort of serious problems. Fixes: 036012386e44 ("ima: rot: Introduce basic framework") Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: rot: Introduce basic framework hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- Each type of RoT devices should have a corresponding entry in ima_rots, a static array that represents entries' priority with their order. In case that ima_rot= is absent, the first device (which means with higher priority) that gets successfully initialized will be the RoT. Otherwise, the framework will only try to initialize the one specified by ima_rot=, and there will be no RoT if the initialization fails. All necessary hooks and variables of the RoT entry should be set at least when .init() is finished. Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: rot: Make RoT kick in hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- Now the RoT framework starts working, by replacing ima_tpm_chip and those relavant function calls to their RoT counterparts. Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: fix buffer overrun in ima_eventdigest_init_common stable inclusion from stable-v6.6.63 commit 8a84765c62cc0469864e2faee43aae253ad16082 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB75G4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8a84765c62cc0469864e2faee43aae253ad16082 -------------------------------- commit 923168a0631bc42fffd55087b337b1b6c54dcff5 upstream. Function ima_eventdigest_init() calls ima_eventdigest_init_common() with HASH_ALGO__LAST which is then used to access the array hash_digest_size[] leading to buffer overrun. Have a conditional statement to handle this. Fixes: 9fab303a2cb3 ("ima: fix violation measurement list record") Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> Tested-by: Enrico Bravi (PhD at polito.it) <enrico.bravi@huawei.com> Cc: stable@vger.kernel.org # 5.19+ Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5@huawei.com> | 1 年前 | |
ima: define a new template field named 'd-ngv2' and templates In preparation to differentiate between unsigned regular IMA file hashes and fs-verity's file digests in the IMA measurement list, define a new template field named 'd-ngv2'. Also define two new templates named 'ima-ngv2' and 'ima-sigv2', which include the new 'd-ngv2' field. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> | 4 年前 | |
ima: rot: Make RoT kick in hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- Now the RoT framework starts working, by replacing ima_tpm_chip and those relavant function calls to their RoT counterparts. Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
ima: rot: Make RoT kick in hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- Now the RoT framework starts working, by replacing ima_tpm_chip and those relavant function calls to their RoT counterparts. Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 | |
IMA: support virtcca extend assigned register EulerOS inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC8O6M CVE: NA ----------------------------- SecGear uefi measured boot requires ima to support virtcca extend assigned register. Signed-off-by: xuce <xuce10@h-partners.com> | 1 年前 | |
ima: rot: Adapt VirtCCA into Rot hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4I9O -------------------------------- VirtCCA is now fit into the RoT framework, with a lower priority against TPM, which means that the framework will always try to initialize and use TPM first. Nevertheless, users can select VirtCCA to be the IMA RoT with ima_rot=virtcca cmdline. Co-developed-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: Lu Huaxin <luhuaxin1@huawei.com> Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com> | 1 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 3 年前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 5 个月前 | ||
| 2 年前 | ||
| 4 年前 | ||
| 6 个月前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 |