Re: [Linux-ima-user] IMA (latest patches) do not allow creation of in policy files.

[Mimi Z. <zo...@li...>]

On Mon, 2015-06-22 at 11:03 -0600, Curtis Veit wrote:

> # Using groups instead of uid mainly for testing
> # gid functionality
> # group root = 0 may want to go by owner or group?
> # group shadow = 42 needed if above not by owner
> measure func=FILE_CHECK mask=MAY_READ fgroup=0
> appraise func=FILE_CHECK mask=MAY_READ fgroup=0

The security.ima hash value is updated only if the file is in policy.
You're policy doesn't inlcude files opened for write.

appraise func=FILE_CHECK fgroup=0

Mimi