Re: [PATCH] ima: Support euid keyword for buffer measurement

Hi Roberto,

On Wed, 2021-07-07 at 07:15 +0000, Roberto Sassu wrote:

quoted

From: Lakshmi Ramasubramanian [mailto:nramas@linux.microsoft.com]
Sent: Tuesday, July 6, 2021 9:30 PM
On 7/5/2021 4:56 AM, Roberto Sassu wrote:

Hi Roberto,

quoted

This patch makes the 'euid' keyword available for buffer measurement rules,
in the same way as for other rules. Currently, there is only support for
the 'uid' keyword.

With this change, buffer measurement (or non-measurement) can depend

also

quoted

on the process effective UID.

Who (kernel component) will be using this?

Hi Lakshmi

I'm using it in a (not yet submitted) test for digest lists.

It is in a dont_measure rule to try to unload a digest list
without measurement and to check that this is not allowed
if the digest list was measured at addition time (to ensure
completeness of information).

quoted

Maybe you could make this change as part of the patch set in which the
above "euid" support will be used.

I wanted to send the digest lists patch set without anything
else. I could resend the patch as part of that patch set if it is
preferred.

Unless there is another usecase, please keep it with the digest list
tests patch set.

Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>

thanks,

Mimi