Messages in this thread | | | Subject | Re: [PATCH v9 2/8] IMA: add support to measure buffer data hash | From | Tushar Sugandhi <> | Date | Tue, 5 Jan 2021 21:00:07 -0800 |
| |
<snip>
>>> void process_buffer_measurement(struct inode *inode, const void >>> *buf, int size, >>> const char *eventname, enum ima_hooks func, >>> - int pcr, const char *func_data); >>> + int pcr, const char *func_data, >>> + bool measure_buf_hash); >> >> Please abbreviate the boolean name to "hash". The test would then be >> "if (hash == true)" or "if (hash)". >> > Will do.
<snip>
>>> - * process_buffer_measurement - Measure the buffer to ima log. >>> + * process_buffer_measurement - Measure the buffer or the buffer >>> data hash >>> * @inode: inode associated with the object being measured (NULL >>> for KEY_CHECK) >>> * @buf: pointer to the buffer that needs to be added to the log. >>> * @size: size of buffer(in bytes). >>> @@ -787,12 +787,23 @@ int ima_post_load_data(char *buf, loff_t size, >>> * @func: IMA hook >>> * @pcr: pcr to extend the measurement >>> * @func_data: private data specific to @func, can be NULL. >>> + * @measure_buf_hash: measure buffer hash >> >> ^@hash: measure buffer data hash >> > Agreed. Will fix. <snip> >>> void process_buffer_measurement(struct inode *inode, const void >>> *buf, int size, >>> const char *eventname, enum ima_hooks func, >>> - int pcr, const char *func_data) >>> + int pcr, const char *func_data, >>> + bool measure_buf_hash) >>> { >>> int ret = 0; >>> const char *audit_cause = "ENOMEM"; >>> @@ -807,6 +818,8 @@ void process_buffer_measurement(struct inode >>> *inode, const void *buf, int size, >>> struct ima_digest_data hdr; >>> char digest[IMA_MAX_DIGEST_SIZE]; >>> } hash = {}; >>> + char buf_hash[IMA_MAX_DIGEST_SIZE]; >>> + int buf_hash_len = hash_digest_size[ima_hash_algo]; >>> int violation = 0; >>> int action = 0; >>> u32 secid; >>> @@ -849,13 +862,27 @@ void process_buffer_measurement(struct inode >>> *inode, const void *buf, int size, >>> goto out; >>> } >>> + if (measure_buf_hash) { >> >> ^ if (hash) { > Yes. >>> + memcpy(buf_hash, hash.hdr.digest, buf_hash_len); >>> + >>> + ret = ima_calc_buffer_hash(buf_hash, buf_hash_len, >>> + iint.ima_hash); >>> + if (ret < 0) { >>> + audit_cause = "measure_buf_hash_error";
Hi Mimi, There already exist a local struct variable named "hash" in p_b_m(). I was thinking of using "buf_hash", but that one is taken too. Maybe I should use "buf_hash" for the input bool, and rename the existing "buf_hash" local variable to "digest_hash"? Does it sound ok?
Thanks, Tushar
<snip>
| |