Re: [PATCH] IMA: Use the system trusted keyrings instead of .ima_mok (update)

[Mimi Zohar]

On Wed, 2016-04-06 at 19:10 +0100, David Howells wrote:
> Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:
> 
> > I'm not sure what you're asking.  If you're asking if the whole file can
> > be include based on whether this option is enabled, then no.
> 
> No - but integrity_init_keyring() just returns if init_keyring is false - but
> this is a variable and is assigned storage, despite the fact that its value is
> only set at compile time as far as I can see.

Originally userspace created the original IMA and EVM keyrings, while
the dot prefixed trusted keyrings were created by the kernel.  The
kernel could just as well create the original underscore prefixed IMA
and EVM keyrings.

Mimi