All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tushar Sugandhi <tusharsu@linux.microsoft.com>
To: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: zohar@linux.ibm.com, stephen.smalley.work@gmail.com,
	casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com,
	gmazyland@gmail.com, paul@paul-moore.com, sashal@kernel.org,
	jmorris@namei.org, nramas@linux.microsoft.com,
	linux-integrity@vger.kernel.org, selinux@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, dm-devel@redhat.com
Subject: Re: [PATCH v8 4/8] IMA: add policy rule to measure critical data
Date: Sat, 12 Dec 2020 09:34:28 -0800	[thread overview]
Message-ID: <157daf28-9b59-bb3a-9b14-17d5aa0a9943@linux.microsoft.com> (raw)
In-Reply-To: <20201212144741.GH4951@sequoia>


>>>> +	case CRITICAL_DATA:
>>>> +		if (!rule->data_source)
>>>> +			return true;
>>>> +
>>>> +		opt_list = rule->data_source;
>>>> +		break;
>>>
>>> I guess this case should unconditionally return true in this patch and
>>> then the include this additional logic in the next patch.
>>>
>>> Sorry, I missed these on my last review.
>>>
>> No worries.
>>
>> As I mentioned above, I kept it purposefully in this patch since
>> my impression was rule->data_source is not part of the user facing
>> policy.
>>
>> But I can simply return true here as you suggested, and move the logic to
>> the next patch.
> 
> I understand the thinking that it isn't harmful in this patch but I
> think it is a bit cleaner to introduce the data_source policy language
> element and all of its backend support in the same patch. Please move it
> to the next patch. Thanks!
> 
> Tyler
> 
Will do.
Thanks a lot Tyler for a detailed review. Appreciate it.

~Tushar




WARNING: multiple messages have this Message-ID (diff)
From: Tushar Sugandhi <tusharsu@linux.microsoft.com>
To: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: sashal@kernel.org, paul@paul-moore.com, snitzer@redhat.com,
	selinux@vger.kernel.org, stephen.smalley.work@gmail.com,
	jmorris@namei.org, zohar@linux.ibm.com,
	linux-kernel@vger.kernel.org, nramas@linux.microsoft.com,
	linux-security-module@vger.kernel.org, casey@schaufler-ca.com,
	linux-integrity@vger.kernel.org, dm-devel@redhat.com,
	gmazyland@gmail.com, agk@redhat.com
Subject: Re: [dm-devel] [PATCH v8 4/8] IMA: add policy rule to measure critical data
Date: Sat, 12 Dec 2020 09:34:28 -0800	[thread overview]
Message-ID: <157daf28-9b59-bb3a-9b14-17d5aa0a9943@linux.microsoft.com> (raw)
In-Reply-To: <20201212144741.GH4951@sequoia>


>>>> +	case CRITICAL_DATA:
>>>> +		if (!rule->data_source)
>>>> +			return true;
>>>> +
>>>> +		opt_list = rule->data_source;
>>>> +		break;
>>>
>>> I guess this case should unconditionally return true in this patch and
>>> then the include this additional logic in the next patch.
>>>
>>> Sorry, I missed these on my last review.
>>>
>> No worries.
>>
>> As I mentioned above, I kept it purposefully in this patch since
>> my impression was rule->data_source is not part of the user facing
>> policy.
>>
>> But I can simply return true here as you suggested, and move the logic to
>> the next patch.
> 
> I understand the thinking that it isn't harmful in this patch but I
> think it is a bit cleaner to introduce the data_source policy language
> element and all of its backend support in the same patch. Please move it
> to the next patch. Thanks!
> 
> Tyler
> 
Will do.
Thanks a lot Tyler for a detailed review. Appreciate it.

~Tushar



--
dm-devel mailing list
dm-devel@redhat.com
https://www.redhat.com/mailman/listinfo/dm-devel


  reply	other threads:[~2020-12-12 17:35 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-11 23:57 [PATCH v8 0/8] IMA: support for measuring kernel integrity critical data Tushar Sugandhi
2020-12-11 23:57 ` [dm-devel] " Tushar Sugandhi
2020-12-11 23:58 ` [PATCH v8 1/8] IMA: generalize keyring specific measurement constructs Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-12  0:08   ` Tyler Hicks
2020-12-12  0:08     ` [dm-devel] " Tyler Hicks
2020-12-11 23:58 ` [PATCH v8 2/8] IMA: add support to measure buffer data hash Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-12  0:09   ` Tyler Hicks
2020-12-12  0:09     ` [dm-devel] " Tyler Hicks
2020-12-11 23:58 ` [PATCH v8 3/8] IMA: define a hook to measure kernel integrity critical data Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-12  0:13   ` Tyler Hicks
2020-12-12  0:13     ` [dm-devel] " Tyler Hicks
2020-12-11 23:58 ` [PATCH v8 4/8] IMA: add policy rule to measure " Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-12  0:25   ` Tyler Hicks
2020-12-12  0:25     ` [dm-devel] " Tyler Hicks
2020-12-12  1:17     ` Tushar Sugandhi
2020-12-12  1:17       ` [dm-devel] " Tushar Sugandhi
2020-12-12 14:47       ` Tyler Hicks
2020-12-12 14:47         ` [dm-devel] " Tyler Hicks
2020-12-12 17:34         ` Tushar Sugandhi [this message]
2020-12-12 17:34           ` Tushar Sugandhi
2020-12-11 23:58 ` [PATCH v8 5/8] IMA: limit critical data measurement based on a label Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-11 23:58 ` [PATCH v8 6/8] IMA: extend critical data hook to limit the " Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-11 23:58 ` [PATCH v8 7/8] IMA: define a builtin critical data measurement policy Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-11 23:58 ` [PATCH v8 8/8] selinux: include a consumer of the new IMA critical data hook Tushar Sugandhi
2020-12-11 23:58   ` [dm-devel] " Tushar Sugandhi
2020-12-12  0:32   ` Tyler Hicks
2020-12-12  0:32     ` [dm-devel] " Tyler Hicks
2020-12-12  0:33     ` Lakshmi Ramasubramanian
2020-12-12  0:33       ` [dm-devel] " Lakshmi Ramasubramanian

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=157daf28-9b59-bb3a-9b14-17d5aa0a9943@linux.microsoft.com \
    --to=tusharsu@linux.microsoft.com \
    --cc=agk@redhat.com \
    --cc=casey@schaufler-ca.com \
    --cc=dm-devel@redhat.com \
    --cc=gmazyland@gmail.com \
    --cc=jmorris@namei.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=nramas@linux.microsoft.com \
    --cc=paul@paul-moore.com \
    --cc=sashal@kernel.org \
    --cc=selinux@vger.kernel.org \
    --cc=snitzer@redhat.com \
    --cc=stephen.smalley.work@gmail.com \
    --cc=tyhicks@linux.microsoft.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.