moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

evm: Deprecate EVM_ALLOW_METADATA_WRITES

Browse Source 
This patch deprecates the usage of EVM_ALLOW_METADATA_WRITES, as it is no
longer necessary. All the issues that prevent the usage of EVM portable
signatures just with a public key loaded have been solved.

This flag will remain available for a short time to ensure that users are
able to use EVM without it.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Roberto Sassu
2021-05-14 17:27:50 +02:00
committed by Mimi Zohar
parent 1886ab01a3
commit 1434c6a1d3
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
Documentation/ABI/testing/evm
View File

@@ -24,7 +24,7 @@ Description:
1 Enable digital signature validation 1 Enable digital signature validation
2 Permit modification of EVM-protected metadata at 2 Permit modification of EVM-protected metadata at
runtime. Not supported if HMAC validation and runtime. Not supported if HMAC validation and
creation is enabled. creation is enabled (deprecated).
31 Disable further runtime modification of EVM policy 31 Disable further runtime modification of EVM policy
=== ================================================== === ==================================================
@@ -47,7 +47,13 @@ Description:
will enable digital signature validation, permit will enable digital signature validation, permit
modification of EVM-protected metadata and modification of EVM-protected metadata and
disable all further modification of policy disable all further modification of policy. This option is now
deprecated in favor of::
echo 0x80000002 ><securityfs>/evm
as the outstanding issues that prevent the usage of EVM portable
signatures have been solved.
Echoing a value is additive, the new value is added to the Echoing a value is additive, the new value is added to the
existing initialization flags. existing initialization flags.