From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: Mimi Zohar <zohar@linux.ibm.com>, linux-integrity@vger.kernel.org
Cc: eric.snowberg@oracle.com, dhowells@redhat.com,
matthewgarrett@google.com, sashal@kernel.org,
jamorris@linux.microsoft.com, linux-kernel@vger.kernel.org,
keyrings@vger.kernel.org
Subject: Re: [PATCH v9 5/6] IMA: Add support to limit measuring keys
Date: Wed, 27 Nov 2019 16:44:22 -0800 [thread overview]
Message-ID: <18b30666-7c44-f81e-8515-189052007e47@linux.microsoft.com> (raw)
In-Reply-To: <1574880741.4793.292.camel@linux.ibm.com>
On 11/27/19 10:52 AM, Mimi Zohar wrote:
Hi Mimi,
>> +static bool ima_match_keyring(struct ima_rule_entry *rule,
>> + const char *keyring)
>> +{
>> + /*
>> + * "keyrings=" is specified in the policy in the format below:
>> + * keyrings=.builtin_trusted_keys|.ima|.evm
>> + *
>> + * Each keyring name in the option is separated by a '|' and
>> + * the last keyring name is null terminated.
>> + *
>> + * The given keyring is considered matched only if
>> + * the whole keyring name matched a keyring name specified
>> + * in the "keyrings=" option.
>> + */
>> + p = strstr(rule->keyrings, keyring);
>> + if (p) {
>> + /*
>> + * Found a substring match. Check if the character
>> + * at the end of the keyring name is | (keyring name
>> + * separator) or is the terminating null character.
>> + * If yes, we have a whole string match.
>> + */
>> + p += strlen(keyring);
>> + if (*p == '|' || *p == '\0')
>> + return true;
>> + }
>> +
>
> Using "while strsep()" would simplify this code, removing the need for
> such a long comment.
>
> Mimi
strsep() modifies the source string (replaces the delimiter with '\0'
and also updates the source string pointer). I am not sure it can be
used for our scenario. Please correct me if I am wrong.
Initial IMA policy:
-------------------
measure func=KEY_CHECK
keyrings=.ima|.evm|.builtin_trusted_keys|.blacklist template=ima-buf
Policy after adding a key to .ima keyring:
------------------------------------------
measure func=KEY_CHECK keyrings=.evm|.builtin_trusted_keys|.blacklist
template=ima-buf
Policy after adding a key to a keyring that is not listed in the policy:
------------------------------------------------------------------------
measure func=KEY_CHECK keyrings= template=ima-buf
********************************************************************************
Please see the description from the man page for strsep():
http://man7.org/linux/man-pages/man3/strsep.3.html
char *strsep(char **stringp, const char *delim);
This function finds the first token in the string *stringp, that is
delimited by one of the bytes in the string delim. This token is
terminated by overwriting the delimiter with a null byte ('\0'), and
*stringp is updated to point past the token.
thanks,
-lakshmi
next prev parent reply other threads:[~2019-11-28 0:44 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-27 1:56 [PATCH v9 0/6] KEYS: Measure keys when they are created or updated Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 1/6] IMA: Check IMA policy flag Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 2/6] IMA: Add KEY_CHECK func to measure keys Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 3/6] IMA: Define an IMA hook " Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 4/6] KEYS: Call the " Lakshmi Ramasubramanian
2019-11-27 1:56 ` [PATCH v9 5/6] IMA: Add support to limit measuring keys Lakshmi Ramasubramanian
2019-11-27 18:52 ` Mimi Zohar
2019-11-28 0:44 ` Lakshmi Ramasubramanian [this message]
2019-12-02 18:18 ` Mimi Zohar
2019-12-03 12:25 ` Mimi Zohar
2019-12-03 16:13 ` Lakshmi Ramasubramanian
2019-12-03 16:47 ` Mimi Zohar
2019-12-03 19:45 ` Lakshmi Ramasubramanian
2019-12-03 20:06 ` Mimi Zohar
2019-12-03 23:37 ` Lakshmi Ramasubramanian
2019-12-04 11:16 ` Mimi Zohar
2019-12-04 22:43 ` Lakshmi Ramasubramanian
2019-12-04 23:25 ` Mat Martineau
2019-11-27 1:56 ` [PATCH v9 6/6] IMA: Read keyrings= option from the IMA policy Lakshmi Ramasubramanian
2019-11-27 19:32 ` Mimi Zohar
2019-11-27 22:05 ` Lakshmi Ramasubramanian
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=18b30666-7c44-f81e-8515-189052007e47@linux.microsoft.com \
--to=nramas@linux.microsoft.com \
--cc=dhowells@redhat.com \
--cc=eric.snowberg@oracle.com \
--cc=jamorris@linux.microsoft.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=matthewgarrett@google.com \
--cc=sashal@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).