Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     zohar@linux.ibm.com
Cc:     dmitry.kasatkin@gmail.com, jarkko@kernel.org, paul@paul-moore.com,
        jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com,
        linux-integrity@vger.kernel.org,
        linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] ima: Remove EXPERIMENTAL from IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
Date:   Thu,  2 Nov 2023 13:06:17 -0400
Message-Id: <20231102170617.2403495-3-eric.snowberg@oracle.com>
In-Reply-To: <20231102170617.2403495-1-eric.snowberg@oracle.com>
References: <20231102170617.2403495-1-eric.snowberg@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?KpYL+5LaVVxPwlKpMsaidq9EWwAwIg3Y25L3vTxs9L1SgFj9CbSQMJ36N2vZ?=
 =?us-ascii?Q?iYon6wxqd8awILAJXptrJvrOdfhOm26DYtoxK/jDAmuxHszjGQvlrulxAmHt?=
 =?us-ascii?Q?tHwSAR0+/9KdK7EOxfA+oZQd0DIp6j91Sdm839WNFR/7Km+S3Uurba1Efl0h?=
 =?us-ascii?Q?Ow/zO/e3sc7sBMJR9mw68yLdqL1rMJAqWnOAdD7xDUFo7nLDsdFX2AjVnl5C?=
 =?us-ascii?Q?j1fhkqFoacBhdlJlnFav2xFANElBd6Qt38e+KjF2DZtS+TsKb2uhU5eL7Djr?=
 =?us-ascii?Q?1zAL2fDwBLwNYAK7Mz2JfXY7dmT/j0Jv4U1/4wJEYeR6Y2DhHf/+QEtlaM/+?=
 =?us-ascii?Q?TR3kWZxQcv/JdEmQ102ZooktCG40aFAZAnI3q7EpPDPlkzfmKfmUUwqxx7bX?=
 =?us-ascii?Q?+nvafTQKsyVrfIwHYID9l+lwYhKRlLzgOKVbQKYkwyPWR3+/Lt8jSOwzSvu9?=
 =?us-ascii?Q?wDwLB8llvPXgl1t6T4jjCSAzIPZF3M+Y4R5NokGrnV6ioaNAN4aEUTg3Nc0l?=
 =?us-ascii?Q?127YBIZls1XSLZIcr+BUdv6/i6Qr7ktA6JLyF5kbRYHk0+mgwpbUl2TqiDuj?=
 =?us-ascii?Q?BeqpWjLOxnZNLumBr5+RFOf5fUzetxLsHEp5w35dU/bVQ0aqHN3BesxDBuF4?=
 =?us-ascii?Q?rgauf3BIViNouZxb1M2tb9cqQ7JFK/Qbns3gDQXPXkWZMFCHLu2G63wbrppy?=
 =?us-ascii?Q?7b4phnDcP4+ksRunsQMieKPWIu4pgSTYUj6O6NghmvwtI1xBAPeKrnvjJ2Ch?=
 =?us-ascii?Q?dtfZtlkmL/7J6aNgLbYb2O4+DXbH4Oy/LzpKR/SZKEHsNfq35V6tULEl5afV?=
 =?us-ascii?Q?VqTAFefaQg1aFhLq2n6Cfn+9SWI7KmdAPF1dMF65Akt2TW9osxri6yaXj9ix?=
 =?us-ascii?Q?bZrtXRX2zd86yQAcSr+n+fAycIMbRBtFAK7/W6Z188Lnd8OvaXVRFmsfqffP?=
 =?us-ascii?Q?PTncAo2E7Z1aDuzORm3b2FhMbc2FA4rQwesyqILTdaiaBUiDcUgtL38sufNl?=
 =?us-ascii?Q?bQ7itj8kmgl4rv2OwlMmPrU/ONJH+n+rfNAUACzyiyzqJeAkNjXbT1ELb2y0?=
 =?us-ascii?Q?JjDEJ91y6RfO8OumNwU4/mdGLgFc1DSV2xIqIvJd3WsQOj/SCT/j254FwGiL?=
 =?us-ascii?Q?jXZ3dyr93kxwyCH8TvipOAkaIb6QPs6JYHvnKLwcNouhTAC5rOJh3ph4YKXo?=
 =?us-ascii?Q?p0L05qqPmrBPQWrHJ1f7GIbGTobV07nlFjRFl+nVf9rKTYY5yoXGhIiOiLxu?=
 =?us-ascii?Q?43eXmh0tO0UB+13EyWiZ5yeNklx5nCVxRq1Kod6p0RJXpti5ZZNpkVEe3d+q?=
 =?us-ascii?Q?Bwv1IZzFtlliRaw+uqTs6fdz11b3Wo3cwXkA2S0rjzbIWtVzjr/+CVkOe0qM?=
 =?us-ascii?Q?fyd4bVJ1RX2/DUsB7JFNzxUdizsmBaq8rA++cu0e4JIjz/Wi9EXPJtscEJ2x?=
 =?us-ascii?Q?qE3SCM1pmB9VerrRHSlr+yd0cJzo3Qko3mAHOVFGc1c7/698XveCVbCamiVe?=
 =?us-ascii?Q?upSQzxzDyt4Xv5/e5U4xN0Ph/X+GF4CQAQU0OH8LTKNfG2qCDbdqq5GiV87b?=
 =?us-ascii?Q?5elTfPCByMfhjo/fpQH1f0fCEPotcK+T9g3KvOU09X+m1coEANxqEVGwKVGd?=
 =?us-ascii?Q?mxLyyPY5eMtitxWfVy81xaw=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?3+iBcpx02hmIMFvmwheO+ayA0znPx/ED8XTbJ14o9E0bbqzK5KR8UrJFWe0h?=
 =?us-ascii?Q?c1/vdyOxc+eqPJY5BoZTOjS6+YT6JSDKlNZlWLfAjH5lQFScVTmeRUEDwkTq?=
 =?us-ascii?Q?UK/bm5yrW6oIocQbBx4ridiHVdOnVV9dZwStnsES/+5g38wjLR1Da/dXqu/y?=
 =?us-ascii?Q?WG8hPVzrV81xnXNjH9YR3evXMYwdzq2F/m96kNY8mIxqFUWpgHw2ImRdslof?=
 =?us-ascii?Q?PdNUon5J7hmh/zck3LDZH3jzVmafKGmxrn2+GBjWzSrYW2+fQbAXZ+BSu7Wj?=
 =?us-ascii?Q?FNTZsscS9uWWXR9Onz32XauyZfndUe5oddEqReKq1fzznD2iY85CgO2TDYrO?=
 =?us-ascii?Q?p0DfSekPrc9ZHlyf/yIb+8IRcC5Age1eu3WzhMDdohRKH65xg92kQ5Msaydl?=
 =?us-ascii?Q?vVfkzyf4Jp8AFYeHjjnKndVx+FkjuCc91oyqQWBIhecC3HnMmMQD2lb+bZWp?=
 =?us-ascii?Q?5lG2EkZAoPyYQr21/OL8x3Jsh6wC2Wf0PziMG8HlfTZgTCiL7OhkspOC/tHV?=
 =?us-ascii?Q?J5t5Sb9F0sgsdYLIUsSJqZe2yIVLeaBsVAyiKt36NRJy8W9EoKQj/0baHWD9?=
 =?us-ascii?Q?HWcEAWz8Mk+DSOHO/LBmn/gzXuh1VFTNIbe8NQwSgBS6EPF3qttIkPyph4EY?=
 =?us-ascii?Q?Ci6iI79MV4VHiHJfX6g1S0+qRlrs7+dLwl51MAL4RsxS5IOWV/0I5G8/knr2?=
 =?us-ascii?Q?FfX9darhtMeRsNPZDPmSOpWqOHGMfuVxDd0rCAIBfQj67PsrvBJFgyyalDkG?=
 =?us-ascii?Q?Sm9IoIKgWWeBYwcmzQVFHExes2bxcc9EiPdKTcsuRlHCM1irGqxDqScf6PIe?=
 =?us-ascii?Q?ctDAaN3l8rjXnfhjme5p0b0NuZnFf9QRi6vscsYx3RvWAsWOhQavnAUq32k3?=
 =?us-ascii?Q?ED3AaUTb8okJewJPHxT4oxXRkrJ50+SD1r5uf6xyuZjhQgrIsI9xxtU/BzpH?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e94ae4f8-ed56-41e1-30db-08dbdbc6ce09
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2023 17:11:51.2736
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: vps0zmIw+JAYnZgsnE5I2D93cmz8b5MGOxw3tYYe7TkOG995cKeXSocgsDehRYvdh5sfyPkBZzIkApvC780PFdNUi7otWPP15gy8Rmz5Z0w=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR10MB7139
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.987,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-11-02_07,2023-11-02_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0 spamscore=0
 phishscore=0 mlxlogscore=999 adultscore=0 mlxscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2310240000
 definitions=main-2311020140
X-Proofpoint-GUID: sgMZWKg-Gle3q7GBFp3aKYm5DoEyutWt
X-Proofpoint-ORIG-GUID: sgMZWKg-Gle3q7GBFp3aKYm5DoEyutWt
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Thu, 02 Nov 2023 10:12:25 -0700 (PDT)

Remove the EXPERIMENTAL from the
IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY Kconfig
now that digitalSignature usage enforcement is set.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
link: https://lore.kernel.org/all/20230508220708.2888510-4-eric.snowberg@oracle.com/
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
 security/integrity/ima/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index c5dc0fabbc8b..2b99c734d5ac 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -243,7 +243,7 @@ config IMA_APPRAISE_MODSIG
 	   to accept such signatures.
 
 config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
-	bool "Permit keys validly signed by a built-in, secondary or machine CA cert (EXPERIMENTAL)"
+	bool "Permit keys validly signed by a built-in, secondary or machine CA cert"
 	depends on SYSTEM_TRUSTED_KEYRING
 	depends on SECONDARY_TRUSTED_KEYRING
 	depends on INTEGRITY_ASYMMETRIC_KEYS
-- 
2.39.3