lkml.org 
[lkml]   [2018]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v2] ima: drop vla in ima_audit_measurement()
From
Date
On Thu, 2018-03-08 at 13:23 -0700, Tycho Andersen wrote:

> /*
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 2cfb0c714967..356faae6f09c 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -288,8 +288,11 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
> xattr_value, xattr_len, opened);
> inode_unlock(inode);
> }
> - if (action & IMA_AUDIT)
> - ima_audit_measurement(iint, pathname);
> + if (action & IMA_AUDIT) {
> + rc = ima_audit_measurement(iint, pathname);
> + if (rc < 0)
> + goto out_locked;
> + }
>
> if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))
> rc = 0;

Only when IMA-appraisal is enforcing file data integrity should
process_measurement() ever fail.  Other errors can be logged/audited.

Mimi

\
 
 \ /
  Last update: 2018-03-08 21:37    [W:0.063 / U:1.520 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site