From: Tycho Andersen <tycho@docker.com> To: Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> Cc: ima-devel <linux-ima-devel@lists.sourceforge.net>, containers <containers@lists.linux-foundation.org>, linux-kernel <linux-kernel@vger.kernel.org>, linux-security-module <linux-security-module@vger.kernel.org>, "Serge E . Hallyn" <serge@hallyn.com>, Yuqiong Sun <sunyuqiong1988@gmail.com>, David Safford <david.safford@ge.com>, Mehmet Kayaalp <mkayaalp@cs.binghamton.edu>, Stefan Berger <stefanb@linux.vnet.ibm.com> Subject: Re: [RFC PATCH 3/5] ima: mamespace audit status flags Date: Tue, 1 Aug 2017 11:17:02 -0600 [thread overview] Message-ID: <20170801171702.f2szj5huzbt7fdfl@docker> (raw) In-Reply-To: <20170720225033.21298-4-mkayaalp@linux.vnet.ibm.com> Hi Mehmet, On Thu, Jul 20, 2017 at 06:50:31PM -0400, Mehmet Kayaalp wrote: > --- a/security/integrity/ima/ima_ns.c > +++ b/security/integrity/ima/ima_ns.c > @@ -301,3 +301,24 @@ struct ns_status *ima_get_ns_status(struct ima_namespace *ns, > > return status; > } > + > +#define IMA_NS_STATUS_ACTIONS IMA_AUDIT > +#define IMA_NS_STATUS_FLAGS IMA_AUDITED > + Seems like these are defined in ima.h above in the patch, and re-defined here? > +unsigned long iint_flags(struct integrity_iint_cache *iint, > + struct ns_status *status) > +{ > + if (!status) > + return iint->flags; > + > + return iint->flags & (status->flags & IMA_NS_STATUS_FLAGS); Just to confirm, is there any situation where: iint->flags & IMA_NS_STATUS_FLAGS != status->flags & IMA_NS_STATUS_FLAGS ? i.e. can this line just be: return status->flags & IMA_NS_STATUS_FLAGS; Tycho > +} > + > +unsigned long set_iint_flags(struct integrity_iint_cache *iint, > + struct ns_status *status, unsigned long flags) > +{ > + iint->flags = flags; > + if (status) > + status->flags = flags & IMA_NS_STATUS_FLAGS; > + return flags; > +} > -- > 2.9.4 >
WARNING: multiple messages have this Message-ID (diff)
From: tycho@docker.com (Tycho Andersen) To: linux-security-module@vger.kernel.org Subject: [RFC PATCH 3/5] ima: mamespace audit status flags Date: Tue, 1 Aug 2017 11:17:02 -0600 [thread overview] Message-ID: <20170801171702.f2szj5huzbt7fdfl@docker> (raw) In-Reply-To: <20170720225033.21298-4-mkayaalp@linux.vnet.ibm.com> Hi Mehmet, On Thu, Jul 20, 2017 at 06:50:31PM -0400, Mehmet Kayaalp wrote: > --- a/security/integrity/ima/ima_ns.c > +++ b/security/integrity/ima/ima_ns.c > @@ -301,3 +301,24 @@ struct ns_status *ima_get_ns_status(struct ima_namespace *ns, > > return status; > } > + > +#define IMA_NS_STATUS_ACTIONS IMA_AUDIT > +#define IMA_NS_STATUS_FLAGS IMA_AUDITED > + Seems like these are defined in ima.h above in the patch, and re-defined here? > +unsigned long iint_flags(struct integrity_iint_cache *iint, > + struct ns_status *status) > +{ > + if (!status) > + return iint->flags; > + > + return iint->flags & (status->flags & IMA_NS_STATUS_FLAGS); Just to confirm, is there any situation where: iint->flags & IMA_NS_STATUS_FLAGS != status->flags & IMA_NS_STATUS_FLAGS ? i.e. can this line just be: return status->flags & IMA_NS_STATUS_FLAGS; Tycho > +} > + > +unsigned long set_iint_flags(struct integrity_iint_cache *iint, > + struct ns_status *status, unsigned long flags) > +{ > + iint->flags = flags; > + if (status) > + status->flags = flags & IMA_NS_STATUS_FLAGS; > + return flags; > +} > -- > 2.9.4 > -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2017-08-01 17:17 UTC|newest] Thread overview: 131+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-07-20 22:50 [RFC PATCH 0/5] ima: namespacing IMA audit messages Mehmet Kayaalp 2017-07-20 22:50 ` Mehmet Kayaalp 2017-07-20 22:50 ` [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Mehmet Kayaalp 2017-07-20 22:50 ` Mehmet Kayaalp [not found] ` <20170720225033.21298-2-mkayaalp-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-25 17:53 ` Serge E. Hallyn 2017-07-25 17:53 ` Serge E. Hallyn 2017-07-25 17:53 ` Serge E. Hallyn [not found] ` <20170725175317.GA727-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> 2017-07-25 18:49 ` James Bottomley 2017-07-25 18:49 ` James Bottomley 2017-07-25 18:49 ` James Bottomley [not found] ` <1501008554.3689.30.camel-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org> 2017-07-25 19:04 ` Serge E. Hallyn 2017-07-25 19:04 ` Serge E. Hallyn 2017-07-25 19:04 ` Serge E. Hallyn 2017-07-25 19:08 ` James Bottomley 2017-07-25 19:08 ` James Bottomley 2017-07-25 19:48 ` Mimi Zohar 2017-07-25 19:48 ` Mimi Zohar [not found] ` <1501012082.27413.17.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-25 20:11 ` Stefan Berger 2017-07-25 20:11 ` Stefan Berger 2017-07-25 20:11 ` Stefan Berger [not found] ` <645db815-7773-e351-5db7-89f38cd88c3d-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-25 20:46 ` Serge E. Hallyn 2017-07-25 20:46 ` Serge E. Hallyn 2017-07-25 20:46 ` Serge E. Hallyn [not found] ` <20170725204622.GA4969-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> 2017-07-25 20:57 ` Mimi Zohar 2017-07-25 20:57 ` Mimi Zohar 2017-07-25 20:57 ` Mimi Zohar [not found] ` <1501016277.27413.50.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-25 21:08 ` Serge E. Hallyn 2017-07-25 21:08 ` Serge E. Hallyn 2017-07-25 21:08 ` Serge E. Hallyn [not found] ` <20170725210801.GA5628-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> 2017-07-25 21:28 ` Mimi Zohar 2017-07-25 21:28 ` Mimi Zohar 2017-07-25 21:28 ` Mimi Zohar [not found] ` <1501018134.27413.66.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-27 12:51 ` [Linux-ima-devel] " Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 12:51 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 12:51 ` Magalhaes, Guilherme (Brazil R&D-CL) [not found] ` <TU4PR84MB03021F7FDF1B89ECAA8F7FFFFFBE0-cn0wsXH2uUebani3oaRudNicc1VoeDReZmpNikb/MY7jO8Y7rvWZVA@public.gmane.org> 2017-07-27 14:39 ` Mimi Zohar 2017-07-27 14:39 ` Mimi Zohar 2017-07-27 14:39 ` Mimi Zohar [not found] ` <1501166369.28419.171.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-27 17:18 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-28 14:19 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 17:18 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 17:18 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 17:49 ` Stefan Berger 2017-07-27 17:49 ` Stefan Berger [not found] ` <3c3d8594-9958-5f53-ec0b-f33c36967f95-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-27 19:39 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 19:39 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 19:39 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-27 20:51 ` Stefan Berger 2017-07-27 20:51 ` Stefan Berger [not found] ` <TU4PR84MB030243E7071B5A7455334886FFBE0-cn0wsXH2uUebani3oaRudNicc1VoeDReZmpNikb/MY7jO8Y7rvWZVA@public.gmane.org> 2017-07-27 20:51 ` Stefan Berger [not found] ` <TU4PR84MB03025AD26718A173FB3E3F94FFBE0-cn0wsXH2uUebani3oaRudNicc1VoeDReZmpNikb/MY7jO8Y7rvWZVA@public.gmane.org> 2017-07-27 17:49 ` Stefan Berger 2017-07-28 14:19 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-28 14:19 ` Magalhaes, Guilherme (Brazil R&D-CL) 2017-07-31 11:31 ` Mimi Zohar 2017-07-31 11:31 ` Mimi Zohar [not found] ` <TU4PR84MB03025BC4B8DEC44A0D63A298FFBF0-cn0wsXH2uUebani3oaRudNicc1VoeDReZmpNikb/MY7jO8Y7rvWZVA@public.gmane.org> 2017-07-31 11:31 ` Mimi Zohar 2017-07-25 21:35 ` Stefan Berger 2017-07-25 21:35 ` Stefan Berger 2017-07-25 21:35 ` Stefan Berger 2018-03-08 14:04 ` Stefan Berger 2018-03-08 14:04 ` Stefan Berger 2018-03-08 14:04 ` Stefan Berger [not found] ` <97839865-b0ab-8e5d-114e-0603ef2edf6f-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2018-03-09 2:59 ` Serge E. Hallyn 2018-03-09 2:59 ` Serge E. Hallyn 2018-03-09 2:59 ` Serge E. Hallyn [not found] ` <20180309025942.GA15295-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> 2018-03-09 13:52 ` Stefan Berger 2018-03-09 13:52 ` Stefan Berger 2018-03-09 13:52 ` Stefan Berger [not found] ` <ec137677-34f8-df91-0d1c-6c6d6c951496-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2018-03-11 22:58 ` James Morris 2018-03-11 22:58 ` James Morris 2018-03-11 22:58 ` James Morris [not found] ` <alpine.LRH.2.21.1803120953310.26512-gx6/JNMH7DfYtjvyW6yDsg@public.gmane.org> 2018-03-13 18:02 ` Stefan Berger 2018-03-13 18:02 ` Stefan Berger 2018-03-13 18:02 ` Stefan Berger [not found] ` <c39350db-046f-ea70-15e4-210884548b1e-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2018-03-13 21:51 ` James Morris 2018-03-13 21:51 ` James Morris 2018-03-13 21:51 ` James Morris 2017-07-25 20:31 ` James Bottomley 2017-07-25 20:31 ` James Bottomley 2017-07-25 20:31 ` James Bottomley [not found] ` <1501014695.3689.41.camel-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org> 2017-07-25 20:47 ` Mimi Zohar 2017-07-25 20:47 ` Mimi Zohar 2017-07-25 20:47 ` Mimi Zohar [not found] ` <1501009739.3689.33.camel-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org> 2017-07-25 19:48 ` Mimi Zohar [not found] ` <20170725190406.GA1883-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> 2017-07-25 19:08 ` James Bottomley 2018-03-08 13:39 ` Stefan Berger 2018-03-08 13:39 ` Stefan Berger 2018-03-08 13:39 ` Stefan Berger [not found] ` <2fac8414-6957-1fce-6b40-ad4b687ca83c-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2018-03-08 20:19 ` Serge E. Hallyn 2018-03-08 20:19 ` Serge E. Hallyn 2018-03-08 20:19 ` Serge E. Hallyn [not found] ` <20180308201931.GA6462-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> 2018-03-08 22:53 ` Stefan Berger 2018-03-08 23:31 ` Serge E. Hallyn 2018-03-08 23:31 ` Serge E. Hallyn [not found] ` <a6ef5679-6aef-21de-7cdb-48e8af83f874-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2018-03-08 23:31 ` Serge E. Hallyn [not found] ` <20170720225033.21298-1-mkayaalp-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-20 22:50 ` Mehmet Kayaalp 2017-07-20 22:50 ` [RFC PATCH 2/5] ima: Add ns_status for storing namespaced iint data Mehmet Kayaalp 2017-07-20 22:50 ` [RFC PATCH 3/5] ima: mamespace audit status flags Mehmet Kayaalp 2017-07-20 22:50 ` [RFC PATCH 4/5] ima: differentiate auditing policy rules from "audit" actions Mehmet Kayaalp 2017-07-20 22:50 ` Mehmet Kayaalp 2017-07-20 22:50 ` Mehmet Kayaalp 2017-07-20 22:50 ` [RFC PATCH 5/5] ima: Add ns_mnt, dev, ino fields to IMA audit measurement msgs Mehmet Kayaalp 2017-07-20 22:50 ` [RFC PATCH 2/5] ima: Add ns_status for storing namespaced iint data Mehmet Kayaalp 2017-07-20 22:50 ` Mehmet Kayaalp [not found] ` <20170720225033.21298-3-mkayaalp-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-25 19:43 ` Serge E. Hallyn 2017-07-25 19:43 ` Serge E. Hallyn 2017-07-25 19:43 ` Serge E. Hallyn [not found] ` <20170725194315.GA2397-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> 2017-07-25 20:15 ` Mimi Zohar 2017-07-25 20:15 ` Mimi Zohar 2017-07-25 20:15 ` Mimi Zohar [not found] ` <1501013725.27413.27.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-07-25 20:25 ` Stefan Berger 2017-07-25 20:25 ` Stefan Berger 2017-07-25 20:25 ` Stefan Berger 2017-07-25 20:49 ` Serge E. Hallyn 2017-07-25 20:49 ` Serge E. Hallyn 2017-07-25 20:49 ` Serge E. Hallyn 2017-08-11 15:00 ` Stefan Berger 2017-08-11 15:00 ` Stefan Berger 2017-08-11 15:00 ` Stefan Berger 2017-07-20 22:50 ` [RFC PATCH 3/5] ima: mamespace audit status flags Mehmet Kayaalp 2017-07-20 22:50 ` Mehmet Kayaalp [not found] ` <20170720225033.21298-4-mkayaalp-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2017-08-01 17:17 ` Tycho Andersen via Containers 2017-08-01 17:17 ` Tycho Andersen [this message] 2017-08-01 17:17 ` Tycho Andersen 2017-08-01 17:25 ` Mehmet Kayaalp 2017-08-01 17:25 ` Mehmet Kayaalp 2017-08-02 21:48 ` Tycho Andersen 2017-08-02 21:48 ` Tycho Andersen 2017-08-01 17:25 ` Mehmet Kayaalp 2017-07-20 22:50 ` [RFC PATCH 5/5] ima: Add ns_mnt, dev, ino fields to IMA audit measurement msgs Mehmet Kayaalp 2017-07-20 22:50 ` Mehmet Kayaalp
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170801171702.f2szj5huzbt7fdfl@docker \ --to=tycho@docker.com \ --cc=containers@lists.linux-foundation.org \ --cc=david.safford@ge.com \ --cc=linux-ima-devel@lists.sourceforge.net \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=mkayaalp@cs.binghamton.edu \ --cc=mkayaalp@linux.vnet.ibm.com \ --cc=serge@hallyn.com \ --cc=stefanb@linux.vnet.ibm.com \ --cc=sunyuqiong1988@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.