diff options
| author | Deven Bowers <deven.desai@linux.microsoft.com> | 2024-08-02 23:08:33 -0700 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-08-20 14:03:47 -0400 |
| commit | ac6731870ed943c7c6a8d4114b3ccaddfbdf7d58 (patch) | |
| tree | cefdb5d8a8801e6d96bbd2c27d192e8c010e3433 /Documentation/filesystems/fsverity.rst | |
| parent | 10ca05a7606519c7ec6a4b48be00ef90822c36a8 (diff) | |
| download | linux-ac6731870ed943c7c6a8d4114b3ccaddfbdf7d58.tar.gz linux-ac6731870ed943c7c6a8d4114b3ccaddfbdf7d58.tar.bz2 linux-ac6731870ed943c7c6a8d4114b3ccaddfbdf7d58.zip | |
documentation: add IPE documentation
Add IPE's admin and developer documentation to the kernel tree.
Co-developed-by: Fan Wu <wufan@linux.microsoft.com>
Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'Documentation/filesystems/fsverity.rst')
| -rw-r--r-- | Documentation/filesystems/fsverity.rst | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst index 362b7a5dc300..0e2fac7a16da 100644 --- a/Documentation/filesystems/fsverity.rst +++ b/Documentation/filesystems/fsverity.rst @@ -92,7 +92,9 @@ authenticating fs-verity file hashes include: "IPE policy" specifically allows for the authorization of fs-verity files using properties ``fsverity_digest`` for identifying files by their verity digest, and ``fsverity_signature`` to authorize - files with a verified fs-verity's built-in signature. + files with a verified fs-verity's built-in signature. For + details on configuring IPE policies and understanding its operational + modes, please refer to :doc:`IPE admin guide </admin-guide/LSM/ipe>`. - Trusted userspace code in combination with `Built-in signature verification`_. This approach should be used only with great care. @@ -508,6 +510,8 @@ be carefully considered before using them: files with a verified fs-verity builtin signature to perform certain operations, such as execution. Note that IPE doesn't require fs.verity.require_signatures=1. + Please refer to :doc:`IPE admin guide </admin-guide/LSM/ipe>` for + more details. - A file's builtin signature can only be set at the same time that fs-verity is being enabled on the file. Changing or deleting the |