lkml.org 
[lkml]   [2019]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v9 5/8] ima: make process_buffer_measurement() generic
From
Date

On 10/24/19 10:20 AM, Lakshmi Ramasubramanian wrote:
> On 10/23/19 8:47 PM, Nayna Jain wrote:
>
> Hi Nayna,
>
>> +void process_buffer_measurement(const void *buf, int size,
>> +                const char *eventname, enum ima_hooks func,
>> +                int pcr)
>>   {
>>       int ret = 0;
>>       struct ima_template_entry *entry = NULL;
>
>> +    if (func) {
>> +        security_task_getsecid(current, &secid);
>> +        action = ima_get_action(NULL, current_cred(), secid, 0, func,
>> +                    &pcr, &template);
>> +        if (!(action & IMA_MEASURE))
>> +            return;
>> +    }
>
> In your change set process_buffer_measurement is called with NONE for
> the parameter func. So ima_get_action (the above if block) will not be
> executed.
>
> Wouldn't it better to update ima_get_action (and related functions) to
> handle the ima policy (func param)?


The idea is to use ima-buf template for the auxiliary measurement
record. The auxiliary measurement record is an additional record to the
one already created based on the existing policy. When func is passed as
NONE, it represents it is an additional record. I am not sure what you
mean by updating ima_get_action, it is already handling the ima policy.

Thanks & Regards,

    - Nayna

\
 
 \ /
  Last update: 2019-10-25 19:26    [W:0.327 / U:0.672 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site