lkml.org 
[lkml]   [2019]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v4 01/10] IMA: Defined an IMA hook to measure keys on key create or update
From
Date

On 11/6/2019 2:43 PM, Mimi Zohar wrote:

>> +void ima_post_key_create_or_update(struct key *keyring, struct key *key,
>> + unsigned long flags, bool create)
>> +{
>> + if ((keyring != NULL) && (key != NULL))
>> + return;
>
> I would move the patch that defines the "keyring=" policy option prior
> to this one.  Include the call to process_buffer_measurement() in this
> patch.  A subsequent patch would add support to defer measuring the
> key, by calling a function named something like
> ima_queue_key_measurement().
>
> Mimi

As I'd stated in the other response, I wanted to isolate all key related
code in a separate C file and build it if and only if all CONFIG
dependencies are met.

I can do the following:

=> Define the IMA hook in ima_asymmetric_keys.c instead of ima_main.c

=> In include/linux/ima.h declare the IMA hook if
CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS is enabled.
Else, NOP it.

#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
extern void ima_post_key_create_or_update(struct key *keyring,
struct key *key,
unsigned long flags,
bool create);
#else
static inline void ima_post_key_create_or_update(struct key *keyring,
struct key *key,
unsigned long flags,
bool create) {}
#endif

Would that be acceptable?

thanks,
-lakshmi


\
 
 \ /
  Last update: 2019-11-07 01:22    [W:0.089 / U:0.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site