Messages in this thread | | | Subject | Re: [PATCH v9 2/8] powerpc/ima: add support to initialize ima policy rules | From | Lakshmi Ramasubramanian <> | Date | Fri, 25 Oct 2019 11:03:03 -0700 |
| |
On 10/25/2019 10:02 AM, Nayna Jain wrote:
>> Is there any way to not use conditional compilation in >> the above array definition? Maybe define different functions to get >> "secure_rules" for when CONFIG_MODULE_SIG_FORCE is defined and when >> it is not defined. > > How will you decide which function to be called ?
Define the array in the C file:
const char *const secure_rules_kernel_check[] = { "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig", NULL };
const char *const secure_rules_kernel_module_check[] = { "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig", "appraise func=MODULE_CHECK appraise_type=imasig|modsig", NULL };
And, in the header file :
extern const char *const secure_rules_kernel_check; extern const char *const secure_rules_kernel_module_check;
#ifdef CONFIG_MODULE_SIG_FORCE const char *secure_rules() { return secure_rules_kernel_check; } #else const char *secure_rules() { return secure_rules_kernel_module_check;} #endif // #ifdef CONFIG_MODULE_SIG_FORCE
If you want to avoid duplication, secure_rules_kernel_check and secure_rules_kernel_module_check could be defined in separate C files and conditionally compiled (in Makefile).
I was just trying to suggest the guidelines given in "Section 21) Conditional Compilation" in coding-style.rst.
It says: Whenever possible don't use preprocessor conditionals (#ifdef, #if) in .c files;...
Feel free to do what you think is appropriate.
thanks, -lakshmi
| |