CONFIG_IMA_MOK_KEYRING: Create IMA machine owner keys (MOK) and blacklist keyrings

General informations

The Linux kernel configuration item CONFIG_IMA_MOK_KEYRING:

• prompt: Create IMA machine owner keys (MOK) and blacklist keyrings
• type: bool
• depends on: ( CONFIG_SYSTEM_TRUSTED_KEYRING ) && ( CONFIG_IMA_TRUSTED_KEYRING )
• defined in security/integrity/ima/Kconfig
• found in Linux kernels: 4.5–4.6

Help text

This option creates IMA MOK and blacklist keyrings. IMA MOK is an intermediate keyring that sits between .system and .ima keyrings, effectively forming a simple CA hierarchy. To successfully import a key into .ima_mok it must be signed by a key which CA is in .system keyring. On turn any key that needs to go in .ima keyring must be signed by CA in either .system or .ima_mok keyrings. IMA MOK is empty at kernel boot.

IMA blacklist keyring contains all revoked IMA keys. It is consulted before any other keyring. If the search is successful the requested operation is rejected and error is returned to the caller.

Hardware

LKDDb

Raw data from LKDDb:

• (none)

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: