From: Bruno Meneguele <bmeneg(a)redhat.com>
redhat/configs: disable {IMA,EVM}_LOAD_X509
Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1977529
This option was enabled by mistake (from my own part): this is only used for
allowing the option {IMA,EVM}_X509_PATH to be set with a specific path in
the system pointing to a valid X509 certificate, specific built for the
integrity subsystem. It turns out that we don't have such certificate and am
not sure it's going to be used anytime soon. In RHEL-8 we've allowed trusted
certificates to the integrity subsystem using the secure boot CA and the
certs used for the kernel build.
With these options set we have the following two error lines in dmesg:
integrity: Unable to open file: /etc/keys/x509_ima.der (-2)
integrity: Unable to open file: /etc/keys/x509_evm.der (-2)
Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
diff --git a/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509
b/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_EVM_LOAD_X509=y
diff --git a/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509
b/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_IMA_LOAD_X509=y
diff --git a/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH
b/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der"
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1234