Re: [PATCH 1/3] libimaevm: Implement imaevm_create_ima_signature

From: Stefan Berger <stefanb@linux.ibm.com>
To: Colin Walters <walters@verbum.org>, linux-integrity@vger.kernel.org
Cc: zohar@linux.ibm.com, Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Subject: Re: [PATCH 1/3] libimaevm: Implement imaevm_create_ima_signature
Date: Tue, 27 Apr 2021 15:13:00 -0400	[thread overview]
Message-ID: <24c40feb-4e98-8641-6af2-11d5c666ef75@linux.ibm.com> (raw)
In-Reply-To: <1add81aa-85e6-68b1-4a48-b19ad33683c6@linux.ibm.com>

On 4/27/21 1:47 PM, Stefan Berger wrote:
>
> On 4/26/21 8:02 PM, Colin Walters wrote:
>>
>> On Tue, Apr 20, 2021, at 2:30 PM, Stefan Berger wrote:
>>
>>> + fd = open(filename, O_RDONLY);
>> Missing O_CLOEXEC.
>
>
> Will do.
>
>>
>>> +int imaevm_create_ima_signature(const char *filename, EVP_PKEY *pkey,
>> It'd maximize flexibility for the caller to pass a file descriptor, 
>> and not a file name.
>
>
> We could do this with a callback where the user implements the 
> callback function and providers buffer, size of buffer, and eof 
> indicator, and gets called for providing the data to hash. That would 
> maybe be even more flexible..

Actually, I cannot do this. For this function we have to call 
ima_calc_hash, which hashes, files, links, directories etc.

     Stefan