Messages in this thread | | | Date | Thu, 18 May 2017 15:39:39 -0600 | From | Tycho Andersen <> | Subject | Re: [RFC 04/11] ima: add support to namespace securityfs file |
| |
Hi Guilherme,
On Thu, May 11, 2017 at 10:59:56AM -0300, Guilherme Magalhaes wrote: > +static int ima_open_namespaces(struct inode *inode, struct file *filp) > +{ > + if (!(filp->f_flags & O_WRONLY)) > + return -EACCES; > + > + if (!capable(CAP_SYS_ADMIN)) > + return -EPERM; > + > + if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags)) > + return -EBUSY;
It probably makes sense to do something like:
if (!(ima_appraise & IMA_APPRAISE_NAMESPACE)) return -EINVAL;
here.
I'll keep playing around with this patchset and see if I have any other feedback.
Cheers,
Tycho
| |