From: Bruno Meneguele <bmeneg(a)redhat.com&gt; redhat/configs: disable {IMA,EVM}_LOAD_X509 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977529 This option was enabled by mistake (from my own part): this is only used for allowing the option {IMA,EVM}_X509_PATH to be set with a specific path in the system pointing to a valid X509 certificate, specific built for the integrity subsystem. It turns out that we don't have such certificate and am not sure it's going to be used anytime soon. In RHEL-8 we've allowed trusted certificates to the integrity subsystem using the secure boot CA and the certs used for the kernel build. With these options set we have the following two error lines in dmesg: integrity: Unable to open file: /etc/keys/x509_ima.der (-2) integrity: Unable to open file: /etc/keys/x509_evm.der (-2) Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com&gt; diff --git a/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509 b/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509 deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_EVM_LOAD_X509 +++ /dev/null @@ -1 +0,0 @@ -CONFIG_EVM_LOAD_X509=y diff --git a/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509 b/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509 deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_IMA_LOAD_X509 +++ /dev/null @@ -1 +0,0 @@ -CONFIG_IMA_LOAD_X509=y diff --git a/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH b/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/CONFIG_IMA_X509_PATH +++ /dev/null @@ -1 +0,0 @@ -CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der" -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1234