LOG_FILE=/root/postinstall-ima.log
[ -n "@NO_SAVE@" ] && LOG_FILE=/dev/null

exec < /dev/tty3 > /dev/tty3
chvt 3
echo "#############"
echo "# %post ima #"
echo "#############"
(
  IMA_STATE="on"
  IMA_POLICY="tcb"
  IMA_APPRAISE="fix"
  IMA_TEMPLATE="ima-ng"

  grubby --update-kernel DEFAULT --args="ima=${IMA_STATE} ima_appraise=${IMA_APPRAISE} ima_canonical_fmt ima_policy=${IMA_POLICY}"
) 2>&1 | tee "${LOG_FILE}"
chvt 1

# vim:set ts=2 sw=2 et:

