ima: add Kconfig default measurement list template

This patch adds a Kconfig option to select the default IMA
measurement list template.  The 'ima' template limited the
filedata hash to 20 bytes and the pathname to 255 charaters.
The 'ima-ng' measurement list template permits larger hash
digests and longer pathnames.

Changelog:
- keep 'select CRYPTO_HASH_INFO' in 'config IMA' section (Kconfig)
  (Roberto Sassu);
- removed trailing whitespaces (Roberto Sassu).
- Lindent fixes

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>

2 files changed, 27 insertions, 2 deletions

diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index e6628e783df1..de26cc873ae6 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -46,6 +46,31 @@ config IMA_LSM_RULES
         help
           Disabling this option will disregard LSM based policy rules.
 
+choice
+        prompt "Default template"
+        default IMA_NG_TEMPLATE
+        depends on IMA
+        help
+          Select the default IMA measurement template.
+
+          The original 'ima' measurement list template contains a
+          hash, defined as 20 bytes, and a null terminated pathname,
+          limited to 255 characters.  The 'ima-ng' measurement list
+          template permits both larger hash digests and longer
+          pathnames.
+
+        config IMA_TEMPLATE
+                bool "ima"
+        config IMA_NG_TEMPLATE
+                bool "ima-ng (default)"
+endchoice
+
+config IMA_DEFAULT_TEMPLATE
+        string
+        depends on IMA
+        default "ima" if IMA_TEMPLATE
+        default "ima-ng" if IMA_NG_TEMPLATE
+
 config IMA_APPRAISE
         bool "Appraise integrity measurements"
         depends on IMA
diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
index 1c4cf194592c..c28ff9bf8f32 100644
--- a/security/integrity/ima/ima_template.c
+++ b/security/integrity/ima/ima_template.c
@@ -127,8 +127,8 @@ static int init_defined_templates(void)
 struct ima_template_desc *ima_template_desc_current(void)
 {
         if (!ima_template)
-                ima_template = lookup_template_desc(IMA_TEMPLATE_IMA_NAME);
-
+                ima_template =
+                    lookup_template_desc(CONFIG_IMA_DEFAULT_TEMPLATE);
         return ima_template;
 }