[gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/integrity/docs: ima-guide.xml

["Sven Vermeulen (swift)" <swift@gentoo.org>]

swift       13/01/04 18:39:13

  Modified:             ima-guide.xml
  Log:
  Add reference to patch needed for custom IMA policies

Revision  Changes    Path
1.8                  xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml

file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml?rev=1.8&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml?rev=1.8&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml?r1=1.7&r2=1.8

Index: ima-guide.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- ima-guide.xml	29 Dec 2012 21:31:17 -0000	1.7
+++ ima-guide.xml	4 Jan 2013 18:39:13 -0000	1.8
@@ -1,6 +1,6 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <!DOCTYPE guide SYSTEM "/dtd/guide.dtd">
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml,v 1.7 2012/12/29 21:31:17 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml,v 1.8 2013/01/04 18:39:13 swift Exp $ -->
 
 <guide lang="en">
 <title>Using Integrity Measurement Architecture in Gentoo</title>
@@ -21,8 +21,8 @@
 <!-- See http://creativecommons.org/licenses/by-sa/3.0 -->
 <license version="3.0" />
 
-<version>7</version>
-<date>2012-12-29</date>
+<version>8</version>
+<date>2013-01-04</date>
 
 <chapter>
 <title>Purpose of IMA</title>
@@ -545,6 +545,9 @@
 dont_appraise fsmagic=0xf97cff8c
 <comment># CGROUP_SUPER_MAGIC = 0x27e0eb</comment>
 dont_appraise fsmagic=0x27e0eb
+<comment># Some defaults for measurement</comment>
+measure func=FILE_MMAP mask=MAY_EXEC
+measure func=BPRM_CHECK mask=MAY_EXEC
 <comment># Do not measure all types that have the "logfile" SELinux attribute
 # You can use seinfo -alogfile -x to get an overview of all these types</comment>
 dont_measure obj_type=initrc_var_log_t
@@ -576,12 +579,18 @@
 dont_appraise obj_type=fsadm_log_t
 dont_appraise obj_type=auditd_log_t
 <comment># Remainder of the defaults</comment>
-measure func=FILE_MMAP mask=MAY_EXEC
-measure func=BPRM_CHECK mask=MAY_EXEC
 measure func=FILE_CHECK mask=MAY_READ uid=0
 appraise fowner=0
 </pre>
 
+<note>
+A small bug in the 3.7 kernel series requires a small <uri 
+link="https://sourceforge.net/mailarchive/message.php?msg_id=30306475">patch</uri>
+to be applied if you are planning on using a custom policy based on SELinux rules
+(actually any LSM-implemented security subsystem rule).
+</note>
+
+
 <p>
 Make sure no empty lines are in the policy; if not, it will be refused. You can
 check the output of <c>dmesg</c> for hints why the policy was refused (it shows
@@ -602,7 +611,7 @@
 #!/sbin/runscript
 # Copyright 1999-2012 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml,v 1.7 2012/12/29 21:31:17 swift Exp $
+# $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/integrity/docs/ima-guide.xml,v 1.8 2013/01/04 18:39:13 swift Exp $
 
 description="Load in custom IMA policy"