lkml.org 
[lkml]   [2019]   [Dec]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] ima: add the ability to query ima for the hash of a given file.
From
Date
On Fri, 2019-12-20 at 08:48 -0800, Lakshmi Ramasubramanian wrote:
> On 12/20/2019 8:31 AM, Florent Revest wrote:
>
> >
> > +/**
> > + * ima_file_hash - return the stored measurement if a file has been hashed.
> > + * @file: pointer to the file
> > + * @buf: buffer in which to store the hash
> > + * @buf_size: length of the buffer
> > + *
> > + * On success, output the hash into buf and return the hash algorithm (as
> > + * defined in the enum hash_algo).
>
> > + * If the hash is larger than buf, then only size bytes will be copied. It
> > + * generally just makes sense to pass a buffer capable of holding the largest
> > + * possible hash: IMA_MAX_DIGEST_SIZE
>
> If the given buffer is smaller than the hash length, wouldn't it be
> better to return the required size and a status indicating the buffer is
> not enough. The caller can then call back with the required buffer.
>
> If the hash is truncated the caller may not know if the hash is partial
> or not.

Based on the hash algorithm, the caller would know if the buffer
provided was too small and was truncated.

>
> > + *
> > + * If IMA is disabled or if no measurement is available, return -EOPNOTSUPP.
> > + * If the parameters are incorrect, return -EINVAL.
> > + */
> > +int ima_file_hash(struct file *file, char *buf, size_t buf_size)
> > +{
> > + struct inode *inode;
> > + struct integrity_iint_cache *iint;
> > + size_t copied_size;
> > +
> > + if (!file || !buf)
> > + return -EINVAL;
> > +

Other kernel functions provide a means of determining the needed
buffer size by passing a NULL field.  Instead of failing here, if buf
is NULL, how about returning the hash algorithm?

Mimi

> > + if (!ima_policy_flag)
> > + return -EOPNOTSUPP;
> > +

\
 
 \ /
  Last update: 2019-12-23 18:40    [W:0.072 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site