From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from e28smtp05.in.ibm.com ([125.16.236.5]:37376 "EHLO e28smtp05.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750801AbcBKCIf (ORCPT ); Wed, 10 Feb 2016 21:08:35 -0500 Received: from localhost by e28smtp05.in.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 11 Feb 2016 07:38:32 +0530 Message-ID: <1455156500.2538.268.camel@linux.vnet.ibm.com> Subject: Re: [PATCH v3 19/22] ima: support for kexec image and initramfs From: Mimi Zohar To: Dmitry Kasatkin Cc: linux-security-module , "Eric W. Biederman" , David Woodhouse , Kees Cook , kexec@lists.infradead.org, linux-modules@vger.kernel.org, Rusty Russell , David Howells , fsdevel@vger.kernel.org, Dmitry Torokhov , "Luis R. Rodriguez" Date: Wed, 10 Feb 2016 21:08:20 -0500 In-Reply-To: References: <1454526390-19792-1-git-send-email-zohar@linux.vnet.ibm.com> <1454526390-19792-20-git-send-email-zohar@linux.vnet.ibm.com> <1455146516.2538.237.camel@linux.vnet.ibm.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Sender: owner-linux-modules@vger.kernel.org List-ID: On Thu, 2016-02-11 at 01:55 +0200, Dmitry Kasatkin wrote: > On Feb 11, 2016 1:22 AM, "Mimi Zohar" wrote: > > > > On Wed, 2016-02-10 at 23:09 +0200, Dmitry Kasatkin wrote: > > > On Wed, Feb 3, 2016 at 9:06 PM, Mimi Zohar > wrote: > > > > > > > > - if (read_id == READING_FIRMWARE) > > > > + switch (read_id) { > > > > + case READING_FIRMWARE: > > > > func = FIRMWARE_CHECK; > > > > - else if (read_id == READING_MODULE) > > > > + break; > > > > + case READING_MODULE: > > > > func = MODULE_CHECK; > > > > + break; > > > > + case READING_KEXEC_IMAGE: > > > > + func = KEXEC_CHECK; > > > > + break; > > > > + case READING_KEXEC_INITRAMFS: > > > > + func = INITRAMFS_CHECK; > > > > + break; > > > > + default: > > > > + func = FILE_CHECK; > > > > + break; > > > > + } > > > > > > > > > > I would define a separate function like "int ima_read_id_to_func(id)" > > > which search over the map > > > > > > Something like... > > > > > > struct > > > { > > > int id; > > > int func; > > > } map[] = { > > > { .id = READING_FIRMWARE, .fun = FIRMWARE_CHECK }, > > > ... > > > { -1, 0 } > > > }; > > > > > > > So we stay with the duplication (option 1), but clean it up. That works > > for me. > > > > Actually it may be simpler. > Just define int idmap[MAX_ID] and assign to every id corresponding func. > It will be quick and simple. Unlike the ima_read_id_to_func() above or the original switch/case statement, this method assumes the kernel_read_file_id enumeration stays in sync with ima_hooks. In terms of the ima_read_id_to_func() function, it would iterate over the map[] to find the corresponding .id, whereas the current switch/case is a direct lookup. Perhaps we should defer making a change for now. Mimi From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from e28smtp06.in.ibm.com ([125.16.236.6]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1aTggi-0003IN-Hk for kexec@lists.infradead.org; Thu, 11 Feb 2016 02:08:57 +0000 Received: from localhost by e28smtp06.in.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 11 Feb 2016 07:38:32 +0530 Received: from d28av01.in.ibm.com (d28av01.in.ibm.com [9.184.220.63]) by d28relay03.in.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u1B28RXF3735814 for ; Thu, 11 Feb 2016 07:38:28 +0530 Received: from d28av01.in.ibm.com (localhost [127.0.0.1]) by d28av01.in.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u1B7c4Mv003072 for ; Thu, 11 Feb 2016 13:08:04 +0530 Message-ID: <1455156500.2538.268.camel@linux.vnet.ibm.com> Subject: Re: [PATCH v3 19/22] ima: support for kexec image and initramfs From: Mimi Zohar Date: Wed, 10 Feb 2016 21:08:20 -0500 In-Reply-To: References: <1454526390-19792-1-git-send-email-zohar@linux.vnet.ibm.com> <1454526390-19792-20-git-send-email-zohar@linux.vnet.ibm.com> <1455146516.2538.237.camel@linux.vnet.ibm.com> Mime-Version: 1.0 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "kexec" Errors-To: kexec-bounces+dwmw2=infradead.org@lists.infradead.org To: Dmitry Kasatkin Cc: Dmitry Torokhov , Kees Cook , fsdevel@vger.kernel.org, "Luis R. Rodriguez" , Rusty Russell , kexec@lists.infradead.org, David Howells , linux-security-module , "Eric W. Biederman" , David Woodhouse , linux-modules@vger.kernel.org On Thu, 2016-02-11 at 01:55 +0200, Dmitry Kasatkin wrote: > On Feb 11, 2016 1:22 AM, "Mimi Zohar" wrote: > > > > On Wed, 2016-02-10 at 23:09 +0200, Dmitry Kasatkin wrote: > > > On Wed, Feb 3, 2016 at 9:06 PM, Mimi Zohar > wrote: > > > > > > > > - if (read_id == READING_FIRMWARE) > > > > + switch (read_id) { > > > > + case READING_FIRMWARE: > > > > func = FIRMWARE_CHECK; > > > > - else if (read_id == READING_MODULE) > > > > + break; > > > > + case READING_MODULE: > > > > func = MODULE_CHECK; > > > > + break; > > > > + case READING_KEXEC_IMAGE: > > > > + func = KEXEC_CHECK; > > > > + break; > > > > + case READING_KEXEC_INITRAMFS: > > > > + func = INITRAMFS_CHECK; > > > > + break; > > > > + default: > > > > + func = FILE_CHECK; > > > > + break; > > > > + } > > > > > > > > > > I would define a separate function like "int ima_read_id_to_func(id)" > > > which search over the map > > > > > > Something like... > > > > > > struct > > > { > > > int id; > > > int func; > > > } map[] = { > > > { .id = READING_FIRMWARE, .fun = FIRMWARE_CHECK }, > > > ... > > > { -1, 0 } > > > }; > > > > > > > So we stay with the duplication (option 1), but clean it up. That works > > for me. > > > > Actually it may be simpler. > Just define int idmap[MAX_ID] and assign to every id corresponding func. > It will be quick and simple. Unlike the ima_read_id_to_func() above or the original switch/case statement, this method assumes the kernel_read_file_id enumeration stays in sync with ima_hooks. In terms of the ima_read_id_to_func() function, it would iterate over the map[] to find the corresponding .id, whereas the current switch/case is a direct lookup. Perhaps we should defer making a change for now. Mimi _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec