Re: [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments
From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2019-06-13 19:22:21
Also in:
linux-integrity, lkml
Hi Prakhar, Patches titles in the subject line need to be prefixed with the subsystem, in this case "ima: ". On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote:
This patch adds support in ima to measure kexec cmdline args during soft reboot(kexec_file_load).
Based on the patch title, the word "ima" is redundant. Patch descriptions are suppose to be written in the third person. "This patch adds" is unnecessary. Please review section 3 "Describe your changes" in Documentation/process/submitting-patches.rst.
- A new ima hook ima_kexec_cmdline is defined to be called by the kexec code. - A new function process_buffer_measurement is defined to measure the buffer hash into the ima log. - A new func policy KEXEC_CMDLINE is defined to control the measurement.[Suggested by Mimi] Signed-off-by: Prakhar Srivastava <redacted>
quoted hunk ↗ jump to hunk
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index fd9b01881d17..98e351e13557 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c@@ -292,6 +292,13 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, { int i; + /* only incase of KEXEC_CMDLINE, inode is NULL */ + if (func == KEXEC_CMDLINE) { + if ((rule->flags & IMA_FUNC) && + (rule->func == func) && (!inode))
Thank you for fixing the other formatting issues. Here's another one. Is checking !inode needed? Mimi
+ return true; + return false; + } if ((rule->flags & IMA_FUNC) && (rule->func != func && func != POST_SETATTR)) return false;