Re: [PATCH 1/3 v5] add a new ima hook and policy to measure the cmdline

[Mimi Zohar <zohar@linux.ibm.com>]

> > > +{
> > > +
> > > +     if (action & IMA_MEASURE)
> > > +             ret = ima_store_template(entry, violation, NULL, buf, pcr);
> > > +
> > > +     if (action & IMA_AUDIT)
> > > +             ima_audit_measurement(iint, event_data.filename);
> >
> > The cover letter and patch description say this patch set is limited
> > to measuring the boot command line - IMA-measurement.
> >  ima_audit_measurement() adds file hashes in the audit log, which can
> > be used for security analytics and/or forensics.  This is part of IMA-
> > audit.  The call to ima_audit_measurement() is inappropriate.
> >
> To clarify, in one of the previous versions you mentioned it
> might be helpful to add audit.

The original question was whether the kexec command line should ONLY
be measured.  That decision impacts whether a new function
(process_buffer_measurement) is needed or whether you should still
call process_measurement().

> I might have misunderstood you, but i will remove the
> audit_measurement and make other corrections.
> Thankyou for your feedback.

Even if it was agreed that you were adding the ability to measure and
audit the kexec boot command line, the cover letter, the patch
descriptions and the patches themselves would need to reflect that.
 The call to ima_audit_measurement() would not be hidden like this,
but included as a separate patch.

Mimi