ima: Add dummy boot aggregate to per ima namespace measurement list
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add dummy boot aggregate entry to the ima measurement list, for every new ima namespace, when the first process is born into that namespace. There is at most one TPM chip in the system and one measurement list associated to one of its PCRs. IMA namespace IDs can be re-used after namespace is destroyed. The per namespace boot aggregate entry marks the moment of the ima namespace creation. It is useful when host's root parses the global measurement list to find entries for destroyed containers. If the ima namespace ID is reused, the user will know, that the given entry belongs to a different container. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Showing
想要评论请 注册 或 登录