From: Bruno Meneguele <bmeneg(a)redhat.com>
redhat/configs: enable IMA_ARCH_POLICY for aarch64 and s390x
IMA_ARCH_POLICY was already enabled for x86_64 and ppc64le. Recently,
the IMA code handling EFI was unified under
security/integrity/ima/ima_efi.c and aarch64 with CONFIG_EFI can use it
for the IMA_ARCH_POLICY logic.
In somewhat the same way, s390x has all the bits in upstream to enable
IMA_ARCH_POLICY, which is tied with the IMA_SECURE_AND_OR_TRUSTED_BOOT
that s390x supports with its IPL mode and also make use during KEXEC'ing
a kernel image in their secure boot. With that, I'm proactivelly
enabling IMA_ARCH_POLICY for s390x as well.
Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
diff --git a/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY
b/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY
index blahblah..blahblah 100644
--- a/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY
+++ b/redhat/configs/common/generic/CONFIG_IMA_ARCH_POLICY
@@ -1 +1 @@
-# CONFIG_IMA_ARCH_POLICY is not set
+CONFIG_IMA_ARCH_POLICY=y
diff --git a/redhat/configs/common/generic/powerpc/CONFIG_IMA_ARCH_POLICY
b/redhat/configs/common/generic/powerpc/CONFIG_IMA_ARCH_POLICY
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/common/generic/powerpc/CONFIG_IMA_ARCH_POLICY
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_IMA_ARCH_POLICY=y
diff --git a/redhat/configs/common/generic/x86/CONFIG_IMA_ARCH_POLICY
b/redhat/configs/common/generic/x86/CONFIG_IMA_ARCH_POLICY
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/common/generic/x86/CONFIG_IMA_ARCH_POLICY
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_IMA_ARCH_POLICY=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1216