From 2758d24adfddcb6d8ede1a48a9fe045da79fb244 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mon, 12 Mar 2018 15:31:15 -0400 Subject: Revert "Enable IMA (rhbz 790008)" This reverts commit bb540d20c6388d18e5977f14f35f96318be223e1. A recent change to the EFI lockdown patch forces IMA policy to be loaded when secureboot is used. Unfortunately, we don't have all the pieces in place to have all components fully signed. A F29 change request is planned to address this, so disable IMA for F28. --- kernel-aarch64.config | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) (limited to 'kernel-aarch64.config') diff --git a/kernel-aarch64.config b/kernel-aarch64.config index f241c8b02..52fac6573 100644 --- a/kernel-aarch64.config +++ b/kernel-aarch64.config @@ -2187,17 +2187,9 @@ CONFIG_IIO_TIGHTLOOP_TRIGGER=m CONFIG_IIO_TRIGGERED_BUFFER=m CONFIG_IIO_TRIGGER=y # CONFIG_IKCONFIG is not set -CONFIG_IMA_APPRAISE_BOOTPARAM=y -CONFIG_IMA_APPRAISE=y -# CONFIG_IMA_BLACKLIST_KEYRING is not set -CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y -# CONFIG_IMA_LOAD_X509 is not set +# CONFIG_IMA is not set CONFIG_IMA_LSM_RULES=y CONFIG_IMA_MEASURE_PCR_IDX=10 -CONFIG_IMA_READ_POLICY=y -CONFIG_IMA_TRUSTED_KEYRING=y -CONFIG_IMA_WRITE_POLICY=y -CONFIG_IMA=y # CONFIG_IMG_ASCII_LCD is not set # CONFIG_IMX_IPUV3_CORE is not set # CONFIG_INA2XX_ADC is not set @@ -2317,10 +2309,7 @@ CONFIG_INPUT_WISTRON_BTNS=m CONFIG_INPUT_WM831X_ON=m CONFIG_INPUT=y CONFIG_INPUT_YEALINK=m -CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y -CONFIG_INTEGRITY_AUDIT=y -CONFIG_INTEGRITY_SIGNATURE=y -CONFIG_INTEGRITY=y +# CONFIG_INTEGRITY is not set # CONFIG_INTEL_IDMA64 is not set CONFIG_INTEL_SOC_PMIC_CHTDC_TI=m # CONFIG_INTEL_SOC_PMIC is not set @@ -5668,12 +5657,12 @@ CONFIG_TCG_NSC=m CONFIG_TCG_TIS_I2C_ATMEL=m # CONFIG_TCG_TIS_I2C_INFINEON is not set # CONFIG_TCG_TIS_I2C_NUVOTON is not set +CONFIG_TCG_TIS=m # CONFIG_TCG_TIS_SPI is not set # CONFIG_TCG_TIS_ST33ZP24_I2C is not set # CONFIG_TCG_TIS_ST33ZP24 is not set # CONFIG_TCG_TIS_ST33ZP24_SPI is not set -CONFIG_TCG_TIS=y -CONFIG_TCG_TPM=y +CONFIG_TCG_TPM=m # CONFIG_TCG_VTPM_PROXY is not set # CONFIG_TCG_XEN is not set CONFIG_TCM_FC=m -- cgit