Messages in this thread | | | Subject | Re: [PATCH v10 5/6] IMA: Add support to limit measuring keys | From | Lakshmi Ramasubramanian <> | Date | Tue, 10 Dec 2019 15:23:01 -0800 |
| |
On 12/10/19 2:43 PM, Mimi Zohar wrote:
>> +static bool ima_match_keyring(struct ima_rule_entry *rule, >> + const char *keyring, const struct cred *cred) >> +{ >> + char *keyrings, *next_keyring, *keyrings_ptr; >> + bool matched = false; >> + >> + /* If "keyrings=" is not specified all keys are measured. */ > > With the addiitonal "uid" support this isn't necessarily true any > more. > > Mimi
Will move the check for uid ahead of the check for keyrings.
if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid)) return false;
> >> + if (!rule->keyrings) >> + return true; >> + >> + if (!keyring) >> + return false; >> + >> + if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid)) >> + return false; >> +
thanks, -lakshmi
| |