Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
	linux-integrity@vger.kernel.org
Cc: eric.snowberg@oracle.com, dhowells@redhat.com,
	matthewgarrett@google.com, sashal@kernel.org,
	jamorris@linux.microsoft.com, linux-kernel@vger.kernel.org,
	keyrings@vger.kernel.org
Subject: Re: [PATCH v9 5/6] IMA: Add support to limit measuring keys
Date: Mon, 02 Dec 2019 13:18:34 -0500
Message-ID: <1575310714.4793.420.camel@linux.ibm.com> (raw)
In-Reply-To: <18b30666-7c44-f81e-8515-189052007e47@linux.microsoft.com>

On Wed, 2019-11-27 at 16:44 -0800, Lakshmi Ramasubramanian wrote:
> On 11/27/19 10:52 AM, Mimi Zohar wrote:
> 
> Hi Mimi,
> 
> >> +static bool ima_match_keyring(struct ima_rule_entry *rule,
> >> +			      const char *keyring)
> >> +{
> >> +	/*
> >> +	 * "keyrings=" is specified in the policy in the format below:
> >> +	 *   keyrings=.builtin_trusted_keys|.ima|.evm
> >> +	 *
> >> +	 * Each keyring name in the option is separated by a '|' and
> >> +	 * the last keyring name is null terminated.
> >> +	 *
> >> +	 * The given keyring is considered matched only if
> >> +	 * the whole keyring name matched a keyring name specified
> >> +	 * in the "keyrings=" option.
> >> +	 */
> >> +	p = strstr(rule->keyrings, keyring);
> >> +	if (p) {
> >> +		/*
> >> +		 * Found a substring match. Check if the character
> >> +		 * at the end of the keyring name is | (keyring name
> >> +		 * separator) or is the terminating null character.
> >> +		 * If yes, we have a whole string match.
> >> +		 */
> >> +		p += strlen(keyring);
> >> +		if (*p == '|' || *p == '\0')
> >> +			return true;

This code checks that the keyring name isn't suffixed, but not
prefixed.

> >> +	}
> >> +
> > 
> > Using "while strsep()" would simplify this code, removing the need for
> > such a long comment.
> > 
> > Mimi
> 
> strsep() modifies the source string (replaces the delimiter with '\0' 
> and also updates the source string pointer). I am not sure it can be 
> used for our scenario. Please correct me if I am wrong.
> 
> Initial IMA policy:
> -------------------
> measure func=KEY_CHECK 
> keyrings=.ima|.evm|.builtin_trusted_keys|.blacklist template=ima-buf
> 
> Policy after adding a key to .ima keyring:
> ------------------------------------------
> measure func=KEY_CHECK keyrings=.evm|.builtin_trusted_keys|.blacklist 
> template=ima-buf
> 
> Policy after adding a key to a keyring that is not listed in the policy:
> ------------------------------------------------------------------------
> measure func=KEY_CHECK keyrings= template=ima-buf
> 
> ********************************************************************************
> 
> Please see the description from the man page for strsep():
> 
> http://man7.org/linux/man-pages/man3/strsep.3.html
> 
> char *strsep(char **stringp, const char *delim);
> 
> This function finds the first token in the string *stringp, that is 
> delimited by one of the bytes in the string delim.  This token is 
> terminated by overwriting the delimiter with a null byte ('\0'), and 
> *stringp is updated to point past the token.

Yes, you would have to make a copy of the string before using
strsep().  You could always use kstrdup(), remembering to free it, or
allocate the memory just once, and then just use memcpy.

Mimi


  reply index

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-27  1:56 [PATCH v9 0/6] KEYS: Measure keys when they are created or updated Lakshmi Ramasubramanian
2019-11-27  1:56 ` [PATCH v9 1/6] IMA: Check IMA policy flag Lakshmi Ramasubramanian
2019-11-27  1:56 ` [PATCH v9 2/6] IMA: Add KEY_CHECK func to measure keys Lakshmi Ramasubramanian
2019-11-27  1:56 ` [PATCH v9 3/6] IMA: Define an IMA hook " Lakshmi Ramasubramanian
2019-11-27  1:56 ` [PATCH v9 4/6] KEYS: Call the " Lakshmi Ramasubramanian
2019-11-27  1:56 ` [PATCH v9 5/6] IMA: Add support to limit measuring keys Lakshmi Ramasubramanian
2019-11-27 18:52   ` Mimi Zohar
2019-11-28  0:44     ` Lakshmi Ramasubramanian
2019-12-02 18:18       ` Mimi Zohar [this message]
2019-12-03 12:25   ` Mimi Zohar
2019-12-03 16:13     ` Lakshmi Ramasubramanian
2019-12-03 16:47       ` Mimi Zohar
2019-12-03 19:45     ` Lakshmi Ramasubramanian
2019-12-03 20:06       ` Mimi Zohar
2019-12-03 23:37         ` Lakshmi Ramasubramanian
2019-12-04 11:16           ` Mimi Zohar
2019-12-04 22:43             ` Lakshmi Ramasubramanian
2019-12-04 23:25             ` Mat Martineau
2019-11-27  1:56 ` [PATCH v9 6/6] IMA: Read keyrings= option from the IMA policy Lakshmi Ramasubramanian
2019-11-27 19:32   ` Mimi Zohar
2019-11-27 22:05     ` Lakshmi Ramasubramanian

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1575310714.4793.420.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=dhowells@redhat.com \
    --cc=eric.snowberg@oracle.com \
    --cc=jamorris@linux.microsoft.com \
    --cc=keyrings@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=matthewgarrett@google.com \
    --cc=nramas@linux.microsoft.com \
    --cc=sashal@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org
	public-inbox-index linux-integrity

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git