Messages in this thread | | | Subject | Re: [PATCH 0/3] fs: reduce export usage of kerne_read*() calls | From | Mimi Zohar <> | Date | Fri, 05 Jun 2020 14:37:18 -0400 |
| |
On Fri, 2020-06-05 at 11:15 -0700, Scott Branden wrote: > Hi Mimi, > > On 2020-05-23 7:52 p.m., Mimi Zohar wrote: > > Scott, the change should be straight forward. The additional patch > > needs to: > > - define a new kernel_read_file_id enumeration, like > > FIRMWARE_PARTIAL_READ. > > - Currently ima_read_file() has a comment about pre-allocated firmware > > buffers. Update ima_read_file() to call process_measurement() for the > > new enumeration FIRMWARE_PARTIAL_READ and update ima_post_read_file() > > to return immediately. > Should this be what is in ima_read_file? > { > enum ima_hooks func; > u32 secid;
Please don't remove the existing comment.
> if (read_id != READING_FIRMWARE_PARTIAL_READ) > return 0; > > if (!file) { /* should never happen */ > if (ima_appraise & IMA_APPRAISE_ENFORCE) > return -EACCES; > return 0; > }
This checks for any IMA appraise rule. You want to enforce firmware signature checking only if there is a firmware appraise rule. Refer to ima_post_read_file().
> security_task_getsecid(current, &secid); > return process_measurement(file, current_cred(), secid, NULL, > 0, MAY_READ, FILE_CHECK);
The read_idmap enumeration should be updated similar to the other firmware. Keep the code generic. Refer to ima_post_read_file(). func will be defined as FIRMWARE_CHECK.
thanks,
Mimi
| |