Re: [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Prakhar,

Patches titles in the subject line need to be prefixed with the
subsystem, in this case "ima: ".

On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote:
> This patch adds support in ima to measure kexec cmdline args
> during soft reboot(kexec_file_load).

Based on the patch title, the word "ima" is redundant.  Patch
descriptions are suppose to be written in the third person. "This
patch adds" is unnecessary.  Please review section 3 "Describe your
changes" in Documentation/process/submitting-patches.rst.

> 
> - A new ima hook ima_kexec_cmdline is defined to be called by the
> kexec code.
> - A new function process_buffer_measurement is defined to measure
> the buffer hash into the ima log.
> - A new func policy KEXEC_CMDLINE is defined to control the
>  measurement.[Suggested by Mimi]
> 
> Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com>


> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> index fd9b01881d17..98e351e13557 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -292,6 +292,13 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
>  {
>  	int i;
>  
> +	/* only incase of KEXEC_CMDLINE, inode is NULL */
> +	if (func == KEXEC_CMDLINE) {
> +		if ((rule->flags & IMA_FUNC) &&
> +			(rule->func == func) && (!inode))

Thank you for fixing the other formatting issues.  Here's another one.
 Is checking !inode needed?

Mimi

> +			return true;
> +		return false;
> +	}
>  	if ((rule->flags & IMA_FUNC) &&
>  	    (rule->func != func && func != POST_SETATTR))
>  		return false;
>