Messages in this thread | | | Subject | Re: [PATCH v0 1/2] IMA: Defined queue functions | From | Lakshmi Ramasubramanian <> | Date | Mon, 2 Dec 2019 10:39:25 -0800 |
| |
On 12/2/19 10:00 AM, Mimi Zohar wrote:
> > ima_update_policy() is called from multiple places. Initially, it is > called before a custom policy has been loaded. The call to > ima_process_queued_keys_for_measurement() needs to be moved to within > the test, otherwise it runs the risk of dropping "key" measurements.
static const struct file_operations ima_measure_policy_ops = { .release = ima_release_policy, };
ima_update_policy() is called from ima_release_policy() function.
On my test machine I have the IMA policy in /etc/ima/ima-policy file. When IMA policy is setup from this file, I see ima_release_policy() called (which in turn calls ima_update_policy()).
How can I have ima_update_policy() called before a custom policy is loaded?
If CONFIG_IMA_WRITE_POLICY is enabled, IMA policy can be updated at runtime - which would invoke ima_update_policy().
Is there any other way ima_update_policy() can get called?
> All the queued keys need to be processed at the same time. Afterwards > the queue should be deleted. Unfortunately, the current queue locking > assumes ima_process_queued_keys_for_measurement() is called multiple > times.
When ima_process_queued_keys_for_measurement() is called the first time, the flag ima_process_keys_for_measurement is set to true and all queued keys are processed at that time.
The queue is not used after this point - In the IMA hook the key is processed immediately when ima_process_keys_for_measurement is set to true.
ima_process_queued_keys_for_measurement() can be called multiple times, but on 2nd and subsequent calls it will be a NOP.
> > Perhaps using the RCU method of walking lists would help. I need to > think about it some more. > > Mimi
Please let me know how using RCU method would help.
thanks, -lakshmi
| |