ima: define a set of appraisal rules requiring file signatures

[mirror_ubuntu-artful-kernel.git] / Documentation / admin-guide / kernel-parameters.txt

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 238bd211f36576efacd83bf2104aa8002825b92e..e438a1fca55488e1cc9d24b5bcb924ef43dd33d5 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -972,7 +972,7 @@
                        A valid base address must be provided, and the serial
                        port must already be setup and configured.
 
-               armada3700_uart,<addr>
+               ar3700_uart,<addr>
                        Start an early, polled-mode console on the
                        Armada 3700 serial port at the specified
                        address. The serial port must already be setup
@@ -1477,12 +1477,21 @@
                        in crypto/hash_info.h.
 
        ima_policy=     [IMA]
-                       The builtin measurement policy to load during IMA
-                       setup.  Specyfing "tcb" as the value, measures all
-                       programs exec'd, files mmap'd for exec, and all files
-                       opened with the read mode bit set by either the
-                       effective uid (euid=0) or uid=0.
-                       Format: "tcb"
+                       The builtin policies to load during IMA setup.
+                       Format: "tcb | appraise_tcb | secure_boot"
+
+                       The "tcb" policy measures all programs exec'd, files
+                       mmap'd for exec, and all files opened with the read
+                       mode bit set by either the effective uid (euid=0) or
+                       uid=0.
+
+                       The "appraise_tcb" policy appraises the integrity of
+                       all files owned by root. (This is the equivalent
+                       of ima_appraise_tcb.)
+
+                       The "secure_boot" policy appraises the integrity
+                       of files (eg. kexec kernel image, kernel modules,
+                       firmware, policy, etc) based on file signatures.
 
        ima_tcb         [IMA] Deprecated.  Use ima_policy= instead.
                        Load a policy which meets the needs of the Trusted