Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring

[Mimi Zohar]

On Tue, 2016-01-12 at 15:56 +0000, David Howells wrote:
> Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:
> 
> > > > The name "restrict_link_by_ima_mok()" doesn't reflect that it is either
> > > > the system keyring or the IMA MOK keyring.
> > > 
> > > How about restrict_link_by_ima_trusted()?
> > 
> > Good.  restrict_link_by_ima_trusted would only check the IMA MOK keyring
> > if it was configured.
> 
> And the system keyring?

Only keys signed by the system keyring can be added to the .ima keyring,
unless IMA MOK is enabled.  In that case, keys signed by either the
system or IMA MOK keyring can be added to the .ima keyring.

Mimi