€•jŒsphinx.addnodes”Œdocument”“”)�”}”(Œ rawsource”Œ”Œchildren”]”(Œ translations”Œ LanguagesNode”“”)�”}”(hhh]”(hŒ pending_xref”“”)�”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…”�”}”Œparent”hsbaŒ attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ refdomain”Œstd”Œreftype”Œdoc”Œ reftarget”Œ*/translations/zh_CN/security/IMA-templates”Œmodname”NŒ classname”NŒ refexplicit”ˆuŒtagname”hhh ubh)�”}”(hhh]”hŒChinese (Traditional)”…”�”}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ*/translations/zh_TW/security/IMA-templates”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)�”}”(hhh]”hŒItalian”…”�”}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ*/translations/it_IT/security/IMA-templates”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)�”}”(hhh]”hŒJapanese”…”�”}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ*/translations/ja_JP/security/IMA-templates”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)�”}”(hhh]”hŒKorean”…”�”}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ*/translations/ko_KR/security/IMA-templates”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)�”}”(hhh]”hŒPortuguese (Brazilian)”…”�”}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ*/translations/pt_BR/security/IMA-templates”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)�”}”(hhh]”hŒSpanish”…”�”}”hh–sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ*/translations/sp_SP/security/IMA-templates”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h hhŒ _document”hŒsource”NŒline”NubhŒsection”“”)�”}”(hhh]”(hŒtitle”“”)�”}”(hŒ!IMA Template Management Mechanism”h]”hŒ!IMA Template Management Mechanism”…”�”}”(hh¼h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhh·h²hh³ŒD/var/lib/git/docbuild/linux/Documentation/security/IMA-templates.rst”h´Kubh¶)�”}”(hhh]”(h»)�”}”(hŒ Introduction”h]”hŒ Introduction”…”�”}”(hhÎh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhhËh²hh³hÊh´KubhŒ paragraph”“”)�”}”(hX The original ``ima`` template is fixed length, containing the filedata hash and pathname. The filedata hash is limited to 20 bytes (md5/sha1). The pathname is a null terminated string, limited to 255 characters. To overcome these limitations and to add additional file metadata, it is necessary to extend the current version of IMA by defining additional templates. For example, information that could be possibly reported are the inode UID/GID or the LSM labels either of the inode and of the process that is accessing it.”h]”(hŒ The original ”…”�”}”(hhÞh²hh³Nh´NubhŒliteral”“”)�”}”(hŒ``ima``”h]”hŒima”…”�”}”(hhèh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhhÞubhX÷ template is fixed length, containing the filedata hash and pathname. The filedata hash is limited to 20 bytes (md5/sha1). The pathname is a null terminated string, limited to 255 characters. To overcome these limitations and to add additional file metadata, it is necessary to extend the current version of IMA by defining additional templates. For example, information that could be possibly reported are the inode UID/GID or the LSM labels either of the inode and of the process that is accessing it.”…”�”}”(hhÞh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K hhËh²hubhÝ)�”}”(hXHowever, the main problem to introduce this feature is that, each time a new template is defined, the functions that generate and display the measurements list would include the code for handling a new format and, thus, would significantly grow over the time.”h]”hXHowever, the main problem to introduce this feature is that, each time a new template is defined, the functions that generate and display the measurements list would include the code for handling a new format and, thus, would significantly grow over the time.”…”�”}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KhhËh²hubhÝ)�”}”(hXVThe proposed solution solves this problem by separating the template management from the remaining IMA code. The core of this solution is the definition of two new data structures: a template descriptor, to determine which information should be included in the measurement list; a template field, to generate and display data of a given type.”h]”hXVThe proposed solution solves this problem by separating the template management from the remaining IMA code. The core of this solution is the definition of two new data structures: a template descriptor, to determine which information should be included in the measurement list; a template field, to generate and display data of a given type.”…”�”}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KhhËh²hubhÝ)�”}”(hX^Managing templates with these structures is very simple. To support a new data type, developers define the field identifier and implement two functions, init() and show(), respectively to generate and display measurement entries. Defining a new template descriptor requires specifying the template format (a string of field identifiers separated by the ``|`` character) through the ``ima_template_fmt`` kernel command line parameter. At boot time, IMA initializes the chosen template descriptor by translating the format into an array of template fields structures taken from the set of the supported ones.”h]”(hXaManaging templates with these structures is very simple. To support a new data type, developers define the field identifier and implement two functions, init() and show(), respectively to generate and display measurement entries. Defining a new template descriptor requires specifying the template format (a string of field identifiers separated by the ”…”�”}”(hjh²hh³Nh´Nubhç)�”}”(hŒ``|``”h]”hŒ|”…”�”}”(hj$h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjubhŒ character) through the ”…”�”}”(hjh²hh³Nh´Nubhç)�”}”(hŒ``ima_template_fmt``”h]”hŒima_template_fmt”…”�”}”(hj6h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjubhŒÌ kernel command line parameter. At boot time, IMA initializes the chosen template descriptor by translating the format into an array of template fields structures taken from the set of the supported ones.”…”�”}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KhhËh²hubhÝ)�”}”(hX÷After the initialization step, IMA will call ``ima_alloc_init_template()`` (new function defined within the patches for the new template management mechanism) to generate a new measurement entry by using the template descriptor chosen through the kernel configuration or through the newly introduced ``ima_template`` and ``ima_template_fmt`` kernel command line parameters. It is during this phase that the advantages of the new architecture are clearly shown: the latter function will not contain specific code to handle a given template but, instead, it simply calls the ``init()`` method of the template fields associated to the chosen template descriptor and store the result (pointer to allocated data and data length) in the measurement entry structure.”h]”(hŒ-After the initialization step, IMA will call ”…”�”}”(hjNh²hh³Nh´Nubhç)�”}”(hŒ``ima_alloc_init_template()``”h]”hŒima_alloc_init_template()”…”�”}”(hjVh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjNubhŒâ (new function defined within the patches for the new template management mechanism) to generate a new measurement entry by using the template descriptor chosen through the kernel configuration or through the newly introduced ”…”�”}”(hjNh²hh³Nh´Nubhç)�”}”(hŒ``ima_template``”h]”hŒ ima_template”…”�”}”(hjhh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjNubhŒ and ”…”�”}”(hjNh²hh³Nh´Nubhç)�”}”(hŒ``ima_template_fmt``”h]”hŒima_template_fmt”…”�”}”(hjzh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjNubhŒè kernel command line parameters. It is during this phase that the advantages of the new architecture are clearly shown: the latter function will not contain specific code to handle a given template but, instead, it simply calls the ”…”�”}”(hjNh²hh³Nh´Nubhç)�”}”(hŒ ``init()``”h]”hŒinit()”…”�”}”(hjŒh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjNubhŒ° method of the template fields associated to the chosen template descriptor and store the result (pointer to allocated data and data length) in the measurement entry structure.”…”�”}”(hjNh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K'hhËh²hubhÝ)�”}”(hXThe same mechanism is employed to display measurements entries. The functions ``ima[_ascii]_measurements_show()`` retrieve, for each entry, the template descriptor used to produce that entry and call the show() method for each item of the array of template fields structures.”h]”(hŒNThe same mechanism is employed to display measurements entries. The functions ”…”�”}”(hj¤h²hh³Nh´Nubhç)�”}”(hŒ#``ima[_ascii]_measurements_show()``”h]”hŒima[_ascii]_measurements_show()”…”�”}”(hj¬h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhj¤ubhŒ¢ retrieve, for each entry, the template descriptor used to produce that entry and call the show() method for each item of the array of template fields structures.”…”�”}”(hj¤h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K2hhËh²hubeh}”(h]”Œ introduction”ah ]”h"]”Œ introduction”ah$]”h&]”uh1hµhh·h²hh³hÊh´Kubh¶)�”}”(hhh]”(h»)�”}”(hŒ)Supported Template Fields and Descriptors”h]”hŒ)Supported Template Fields and Descriptors”…”�”}”(hjÏh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhjÌh²hh³hÊh´K:ubhÝ)�”}”(hŒúIn the following, there is the list of supported template fields ``('': description)``, that can be used to define new template descriptors by adding their identifier to the format string (support for more data types will be added later):”h]”(hŒAIn the following, there is the list of supported template fields ”…”�”}”(hjÝh²hh³Nh´Nubhç)�”}”(hŒ!``('': description)``”h]”hŒ('': description)”…”�”}”(hjåh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjÝubhŒ˜, that can be used to define new template descriptors by adding their identifier to the format string (support for more data types will be added later):”…”�”}”(hjÝh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K:digest); - 'd-ngv2': same as d-ng, but prefixed with the "ima" or "verity" digest type (field format: ::digest); - 'd-modsig': the digest of the event without the appended modsig; - 'n-ng': the name of the event, without size limitations; - 'sig': the file signature, based on either the file's/fsverity's digest[1], or the EVM portable signature, if 'security.ima' contains a file hash. - 'modsig' the appended file signature; - 'buf': the buffer data that was used to generate the hash without size limitations; - 'evmsig': the EVM portable signature; - 'iuid': the inode UID; - 'igid': the inode GID; - 'imode': the inode mode; - 'xattrnames': a list of xattr names (separated by ``|``), only if the xattr is present; - 'xattrlengths': a list of xattr lengths (u32), only if the xattr is present; - 'xattrvalues': a list of xattr values; ”h]”hŒ bullet_list”“”)�”}”(hhh]”(hŒ list_item”“”)�”}”(hŒr'd': the digest of the event (i.e. the digest of a measured file), calculated with the SHA1 or MD5 hash algorithm;”h]”hÝ)�”}”(hŒr'd': the digest of the event (i.e. the digest of a measured file), calculated with the SHA1 or MD5 hash algorithm;”h]”hŒv‘d’: the digest of the event (i.e. the digest of a measured file), calculated with the SHA1 or MD5 hash algorithm;”…”�”}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KAhj ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒK'n': the name of the event (i.e. the file name), with size up to 255 bytes;”h]”hÝ)�”}”(hj$h]”hŒO‘n’: the name of the event (i.e. the file name), with size up to 255 bytes;”…”�”}”(hj&h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KChj"ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒp'd-ng': the digest of the event, calculated with an arbitrary hash algorithm (field format: :digest);”h]”hÝ)�”}”(hŒp'd-ng': the digest of the event, calculated with an arbitrary hash algorithm (field format: :digest);”h]”hŒt‘d-ng’: the digest of the event, calculated with an arbitrary hash algorithm (field format: :digest);”…”�”}”(hj=h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KDhj9ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ}'d-ngv2': same as d-ng, but prefixed with the "ima" or "verity" digest type (field format: ::digest);”h]”hÝ)�”}”(hŒ}'d-ngv2': same as d-ng, but prefixed with the "ima" or "verity" digest type (field format: ::digest);”h]”hŒ‰â€˜d-ngv2’: same as d-ng, but prefixed with the “imaâ€� or “verityâ€� digest type (field format: ::digest);”…”�”}”(hjUh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KFhjQubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ@'d-modsig': the digest of the event without the appended modsig;”h]”hÝ)�”}”(hjkh]”hŒD‘d-modsig’: the digest of the event without the appended modsig;”…”�”}”(hjmh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KHhjiubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ8'n-ng': the name of the event, without size limitations;”h]”hÝ)�”}”(hj‚h]”hŒ<‘n-ng’: the name of the event, without size limitations;”…”�”}”(hj„h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KIhj€ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ’'sig': the file signature, based on either the file's/fsverity's digest[1], or the EVM portable signature, if 'security.ima' contains a file hash.”h]”hÝ)�”}”(hŒ’'sig': the file signature, based on either the file's/fsverity's digest[1], or the EVM portable signature, if 'security.ima' contains a file hash.”h]”hŒžâ€˜sig’: the file signature, based on either the file’s/fsverity’s digest[1], or the EVM portable signature, if ‘security.ima’ contains a file hash.”…”�”}”(hj›h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KJhj—ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ%'modsig' the appended file signature;”h]”hÝ)�”}”(hj±h]”hŒ)‘modsig’ the appended file signature;”…”�”}”(hj³h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KLhj¯ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒS'buf': the buffer data that was used to generate the hash without size limitations;”h]”hÝ)�”}”(hjÈh]”hŒW‘buf’: the buffer data that was used to generate the hash without size limitations;”…”�”}”(hjÊh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KMhjÆubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ%'evmsig': the EVM portable signature;”h]”hÝ)�”}”(hjßh]”hŒ)‘evmsig’: the EVM portable signature;”…”�”}”(hjáh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KNhjÝubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ'iuid': the inode UID;”h]”hÝ)�”}”(hjöh]”hŒ‘iuid’: the inode UID;”…”�”}”(hjøh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KOhjôubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ'igid': the inode GID;”h]”hÝ)�”}”(hj h]”hŒ‘igid’: the inode GID;”…”�”}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KPhj ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ'imode': the inode mode;”h]”hÝ)�”}”(hj$h]”hŒ‘imode’: the inode mode;”…”�”}”(hj&h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KQhj"ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒX'xattrnames': a list of xattr names (separated by ``|``), only if the xattr is present;”h]”hŒdefinition_list”“”)�”}”(hhh]”hŒdefinition_list_item”“”)�”}”(hŒW'xattrnames': a list of xattr names (separated by ``|``), only if the xattr is present;”h]”(hŒterm”“”)�”}”(hŒN'xattrnames': a list of xattr names (separated by ``|``), only if the xattr is”h]”(hŒ6‘xattrnames’: a list of xattr names (separated by ”…”�”}”(hjJh²hh³Nh´Nubhç)�”}”(hŒ``|``”h]”hŒ|”…”�”}”(hjRh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjJubhŒ), only if the xattr is”…”�”}”(hjJh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1jHh³hÊh´KRhjDubhŒ definition”“”)�”}”(hhh]”hÝ)�”}”(hŒpresent;”h]”hŒpresent;”…”�”}”(hjoh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KShjlubah}”(h]”h ]”h"]”h$]”h&]”uh1jjhjDubeh}”(h]”h ]”h"]”h$]”h&]”uh1jBh³hÊh´KRhj?ubah}”(h]”h ]”h"]”h$]”h&]”uh1j=hj9ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒL'xattrlengths': a list of xattr lengths (u32), only if the xattr is present;”h]”hÝ)�”}”(hj—h]”hŒP‘xattrlengths’: a list of xattr lengths (u32), only if the xattr is present;”…”�”}”(hj™h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KThj•ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubj )�”}”(hŒ('xattrvalues': a list of xattr values; ”h]”hÝ)�”}”(hŒ&'xattrvalues': a list of xattr values;”h]”hŒ*‘xattrvalues’: a list of xattr values;”…”�”}”(hj°h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KUhj¬ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjubeh}”(h]”h ]”h"]”h$]”h&]”Œbullet”Œ-”uh1jh³hÊh´KAhjÿubah}”(h]”h ]”h"]”h$]”h&]”uh1jýh³hÊh´KAhjÌh²hubhÝ)�”}”(hŒ9Below, there is the list of defined template descriptors:”h]”hŒ9Below, there is the list of defined template descriptors:”…”�”}”(hjÒh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KXhjÌh²hubjþ)�”}”(hXµ- "ima": its format is ``d|n``; - "ima-ng" (default): its format is ``d-ng|n-ng``; - "ima-ngv2": its format is ``d-ngv2|n-ng``; - "ima-sig": its format is ``d-ng|n-ng|sig``; - "ima-sigv2": its format is ``d-ngv2|n-ng|sig``; - "ima-buf": its format is ``d-ng|n-ng|buf``; - "ima-modsig": its format is ``d-ng|n-ng|sig|d-modsig|modsig``; - "evm-sig": its format is ``d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode``; ”h]”j)�”}”(hhh]”(j )�”}”(hŒ"ima": its format is ``d|n``;”h]”hÝ)�”}”(hjéh]”(hŒ“imaâ€�: its format is ”…”�”}”(hjëh²hh³Nh´Nubhç)�”}”(hŒ``d|n``”h]”hŒd|n”…”�”}”(hjòh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjëubhŒ;”…”�”}”(hjëh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KZhjçubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubj )�”}”(hŒ0"ima-ng" (default): its format is ``d-ng|n-ng``;”h]”hÝ)�”}”(hjh]”(hŒ&“ima-ngâ€� (default): its format is ”…”�”}”(hjh²hh³Nh´Nubhç)�”}”(hŒ ``d-ng|n-ng``”h]”hŒ d-ng|n-ng”…”�”}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjubhŒ;”…”�”}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K[hjubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubj )�”}”(hŒ*"ima-ngv2": its format is ``d-ngv2|n-ng``;”h]”hÝ)�”}”(hj;h]”(hŒ“ima-ngv2â€�: its format is ”…”�”}”(hj=h²hh³Nh´Nubhç)�”}”(hŒ``d-ngv2|n-ng``”h]”hŒ d-ngv2|n-ng”…”�”}”(hjDh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhj=ubhŒ;”…”�”}”(hj=h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K\hj9ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubj )�”}”(hŒ+"ima-sig": its format is ``d-ng|n-ng|sig``;”h]”hÝ)�”}”(hjdh]”(hŒ“ima-sigâ€�: its format is ”…”�”}”(hjfh²hh³Nh´Nubhç)�”}”(hŒ``d-ng|n-ng|sig``”h]”hŒ d-ng|n-ng|sig”…”�”}”(hjmh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjfubhŒ;”…”�”}”(hjfh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K]hjbubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubj )�”}”(hŒ/"ima-sigv2": its format is ``d-ngv2|n-ng|sig``;”h]”hÝ)�”}”(hj�h]”(hŒ“ima-sigv2â€�: its format is ”…”�”}”(hj�h²hh³Nh´Nubhç)�”}”(hŒ``d-ngv2|n-ng|sig``”h]”hŒd-ngv2|n-ng|sig”…”�”}”(hj–h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhj�ubhŒ;”…”�”}”(hj�h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K^hj‹ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubj )�”}”(hŒ+"ima-buf": its format is ``d-ng|n-ng|buf``;”h]”hÝ)�”}”(hj¶h]”(hŒ“ima-bufâ€�: its format is ”…”�”}”(hj¸h²hh³Nh´Nubhç)�”}”(hŒ``d-ng|n-ng|buf``”h]”hŒ d-ng|n-ng|buf”…”�”}”(hj¿h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhj¸ubhŒ;”…”�”}”(hj¸h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K_hj´ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubj )�”}”(hŒ>"ima-modsig": its format is ``d-ng|n-ng|sig|d-modsig|modsig``;”h]”hÝ)�”}”(hjßh]”(hŒ “ima-modsigâ€�: its format is ”…”�”}”(hjáh²hh³Nh´Nubhç)�”}”(hŒ!``d-ng|n-ng|sig|d-modsig|modsig``”h]”hŒd-ng|n-ng|sig|d-modsig|modsig”…”�”}”(hjèh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjáubhŒ;”…”�”}”(hjáh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´K`hjÝubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubj )�”}”(hŒd"evm-sig": its format is ``d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode``; ”h]”hÝ)�”}”(hŒb"evm-sig": its format is ``d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode``;”h]”(hŒ“evm-sigâ€�: its format is ”…”�”}”(hj h²hh³Nh´Nubhç)�”}”(hŒH``d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode``”h]”hŒDd-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode”…”�”}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhj ubhŒ;”…”�”}”(hj h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´Kahjubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjäubeh}”(h]”h ]”h"]”h$]”h&]”jÊjËuh1jh³hÊh´KZhjàubah}”(h]”h ]”h"]”h$]”h&]”uh1jýh³hÊh´KZhjÌh²hubeh}”(h]”Œ)supported-template-fields-and-descriptors”ah ]”h"]”Œ)supported template fields and descriptors”ah$]”h&]”uh1hµhh·h²hh³hÊh´K:ubh¶)�”}”(hhh]”(h»)�”}”(hŒUse”h]”hŒUse”…”�”}”(hjGh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhjDh²hh³hÊh´KeubhÝ)�”}”(hŒ}To specify the template descriptor to be used to generate measurement entries, currently the following methods are supported:”h]”hŒ}To specify the template descriptor to be used to generate measurement entries, currently the following methods are supported:”…”�”}”(hjUh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´KghjDh²hubjþ)�”}”(hX^- select a template descriptor among those supported in the kernel configuration (``ima-ng`` is the default choice); - specify a template descriptor name from the kernel command line through the ``ima_template=`` parameter; - register a new template descriptor with custom format through the kernel command line parameter ``ima_template_fmt=``.”h]”j)�”}”(hhh]”(j )�”}”(hŒrselect a template descriptor among those supported in the kernel configuration (``ima-ng`` is the default choice);”h]”hÝ)�”}”(hŒrselect a template descriptor among those supported in the kernel configuration (``ima-ng`` is the default choice);”h]”(hŒPselect a template descriptor among those supported in the kernel configuration (”…”�”}”(hjnh²hh³Nh´Nubhç)�”}”(hŒ ``ima-ng``”h]”hŒima-ng”…”�”}”(hjvh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjnubhŒ is the default choice);”…”�”}”(hjnh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´Kjhjjubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjgubj )�”}”(hŒhspecify a template descriptor name from the kernel command line through the ``ima_template=`` parameter;”h]”hÝ)�”}”(hŒhspecify a template descriptor name from the kernel command line through the ``ima_template=`` parameter;”h]”(hŒLspecify a template descriptor name from the kernel command line through the ”…”�”}”(hj˜h²hh³Nh´Nubhç)�”}”(hŒ``ima_template=``”h]”hŒ ima_template=”…”�”}”(hj h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhj˜ubhŒ parameter;”…”�”}”(hj˜h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´Klhj”ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjgubj )�”}”(hŒvregister a new template descriptor with custom format through the kernel command line parameter ``ima_template_fmt=``.”h]”hÝ)�”}”(hŒvregister a new template descriptor with custom format through the kernel command line parameter ``ima_template_fmt=``.”h]”(hŒ`register a new template descriptor with custom format through the kernel command line parameter ”…”�”}”(hjÂh²hh³Nh´Nubhç)�”}”(hŒ``ima_template_fmt=``”h]”hŒima_template_fmt=”…”�”}”(hjÊh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hæhjÂubhŒ.”…”�”}”(hjÂh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÜh³hÊh´Knhj¾ubah}”(h]”h ]”h"]”h$]”h&]”uh1jhjgubeh}”(h]”h ]”h"]”h$]”h&]”jÊjËuh1jh³hÊh´Kjhjcubah}”(h]”h ]”h"]”h$]”h&]”uh1jýh³hÊh´KjhjDh²hubeh}”(h]”Œuse”ah ]”h"]”Œuse”ah$]”h&]”uh1hµhh·h²hh³hÊh´Keubeh}”(h]”Œ!ima-template-management-mechanism”ah ]”h"]”Œ!ima template management mechanism”ah$]”h&]”uh1hµhhh²hh³hÊh´Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”hÊuh1hŒcurrent_source”NŒ current_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)�”}”(hºNŒ generator”NŒ datestamp”NŒ source_link”NŒ source_url”NŒ toc_backlinks”Œentry”Œfootnote_backlinks”KŒ sectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒ strip_classes”NŒ report_level”KŒ halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ traceback”ˆŒinput_encoding”Œ utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”j'Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œ language_code”Œen”Œrecord_dependencies”NŒconfig”NŒ id_prefix”hŒauto_id_prefix”Œid”Œ dump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”hÊŒ _destination”NŒ _config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒ raw_enabled”KŒline_length_limit”M'Œpep_references”NŒ pep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒ rfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œ smart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œ docinfo_xform”KŒsectsubtitle_xform”‰Œ image_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”Œnameids”}”(jjþjÉjÆjAj>jùjöuŒ nametypes”}”(j‰jɉjA‰jù‰uh}”(jþh·jÆhËj>jÌjöjDuŒ footnote_refs”}”Œ citation_refs”}”Œ autofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ footnotes”]”Œ citations”]”Œautofootnote_start”KŒsymbol_footnote_start”KŒ id_counter”Œ collections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”Œ transformer”NŒ include_log”]”Œ decoration”Nh²hub.