Re: [PATCH 8/9] ABI: security: fix location for evm and ima_policy

Em Thu, 09 Sep 2021 09:48:11 -0400
Mimi Zohar [off-list ref] escreveu:

Hi Mauro,

On Wed, 2021-09-08 at 16:58 +0200, Mauro Carvalho Chehab wrote:

quoted

The What: definitions there are wrong, pointing to different
locations than what's expected.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>  

What is the purpose for the asterisks in the file path?

That's a standard filesystem wildcard. On ABI documents, there are
some other ways to specify it. The most used ones are:

	/sys/kernel/security/*/evm
	/sys/kernel/security/.../evm
	/sys/kernel/security/<something>/evm

(currently, there's no preferences between them)

If you check patches 1-3, the goal here is to have something
that will be replaced by this regex by scripts/get_abi.pl,
e.g. it will turn into:

	/sys/kernel/security/.*/evm

So, this what:

	What:		/sys/kernel/security/evm /sys/kernel/security/*/evm

Matches all three occurrences of evm on my system:

	/sys/kernel/security/evm
	/sys/kernel/security/integrity/evm
	/sys/kernel/security/integrity/evm/evm

Regards,
Mauro

thanks,

Mimi

quoted

---
 Documentation/ABI/testing/evm        | 4 ++--
 Documentation/ABI/testing/ima_policy | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
index 553fd8a33e56..4b76a19b7bb4 100644
--- a/Documentation/ABI/testing/evm
+++ b/Documentation/ABI/testing/evm

@@ -1,4 +1,4 @@
-What:		security/evm
+What:		/sys/kernel/security/evm /sys/kernel/security/*/evm
 Date:		March 2011
 Contact:	Mimi Zohar <zohar@us.ibm.com>
 Description:

@@ -93,7 +93,7 @@ Description:
 		core/ima-setup) have support for loading keys at boot
 		time.
 
-What:		security/integrity/evm/evm_xattrs
+What:		/sys/kernel/security/*/evm/evm_xattrs
 Date:		April 2018
 Contact:	Matthew Garrett <mjg59@google.com>
 Description:

diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index 5c2798534950..2d84063d196f 100644
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy

@@ -1,4 +1,4 @@
-What:		security/ima/policy
+What:		/sys/kernel/security/*/ima/policy
 Date:		May 2008
 Contact:	Mimi Zohar <zohar@us.ibm.com>
 Description: