diff options
| author | Eric Paris <eparis@redhat.com> | 2009-05-12 15:14:23 -0400 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2009-05-15 09:55:44 +1000 |
| commit | c3d20103d08e5c0b6738fbd0acf3ca004e5356c5 (patch) | |
| tree | 4231ff475f11231b3cbca949a7bcad37a9a8cc17 | |
| parent | f850a7c040d9faafb41bceb0a05d6bb7432c8c7a (diff) | |
| download | op-kernel-dev-c3d20103d08e5c0b6738fbd0acf3ca004e5356c5.zip op-kernel-dev-c3d20103d08e5c0b6738fbd0acf3ca004e5356c5.tar.gz | |
IMA: do not measure everything opened by root by default
The IMA default policy measures every single file opened by root. This is
terrible for most users. Consider a system (like mine) with virtual machine
images. When those images are touched (which happens at boot for me) those
images are measured. This is just way too much for the default case.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
| -rw-r--r-- | security/integrity/ima/ima_policy.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index b168c1d..dec6dcb 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -61,8 +61,6 @@ static struct ima_measure_rule_entry default_rules[] = { .flags = IMA_FUNC | IMA_MASK}, {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC, .flags = IMA_FUNC | IMA_MASK}, - {.action = MEASURE,.func = PATH_CHECK,.mask = MAY_READ,.uid = 0, - .flags = IMA_FUNC | IMA_MASK | IMA_UID} }; static LIST_HEAD(measure_default_rules); |
