Merge tag '5.15-rc-cifs-part2' of git://git.samba.org/sfrench/cifs-2.6

[linux-2.6-microblaze.git] / Documentation / ABI / testing / ima_policy

diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index 070779e..5c27985 100644 (file)
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -27,12 +27,13 @@ Description:
                        lsm:    [[subj_user=] [subj_role=] [subj_type=]
                                 [obj_user=] [obj_role=] [obj_type=]]
                        option: [[appraise_type=]] [template=] [permit_directio]
-                               [appraise_flag=] [keyrings=]
+                               [appraise_flag=] [appraise_algos=] [keyrings=]
                  base:
                        func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]
-                               [FIRMWARE_CHECK]
+                               [FIRMWARE_CHECK]
                                [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
                                [KEXEC_CMDLINE] [KEY_CHECK] [CRITICAL_DATA]
+                               [SETXATTR_CHECK]
                        mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
                               [[^]MAY_EXEC]
                        fsmagic:= hex value
@@ -55,6 +56,10 @@ Description:
                        label:= [selinux]|[kernel_info]|[data_label]
                        data_label:= a unique string used for grouping and limiting critical data.
                        For example, "selinux" to measure critical data for SELinux.
+                       appraise_algos:= comma-separated list of hash algorithms
+                       For example, "sha256,sha512" to only accept to appraise
+                       files where the security.ima xattr was hashed with one
+                       of these two algorithms.
 
                  default policy:
                        # PROC_SUPER_MAGIC
@@ -134,3 +139,9 @@ Description:
                keys added to .builtin_trusted_keys or .ima keyring:
 
                        measure func=KEY_CHECK keyrings=.builtin_trusted_keys|.ima
+
+               Example of the special SETXATTR_CHECK appraise rule, that
+               restricts the hash algorithms allowed when writing to the
+               security.ima xattr of a file:
+
+                       appraise func=SETXATTR_CHECK appraise_algos=sha256,sha384,sha512