From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: Mimi Zohar <zohar@linux.ibm.com>,
dhowells@redhat.com, casey@schaufler-ca.com, sashal@kernel.org,
jamorris@linux.microsoft.com,
linux-security-module@vger.kernel.org,
linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
keyrings@vger.kernel.org
Subject: Re: [PATCH v2 1/4] KEYS: Defined an ima hook for measuring keys on key create or update
Date: Mon, 28 Oct 2019 07:58:36 -0700 [thread overview]
Message-ID: <1d7730ff-9847-c6be-4f4f-8cf1e90a71f2@linux.microsoft.com> (raw)
In-Reply-To: <1572187644.4532.211.camel@linux.ibm.com>
On 10/27/19 7:47 AM, Mimi Zohar wrote:
>>> There's no reason to define a new variable to determine if IMA is
>>> initialized. Use ima_policy_flag.
>>
>> Please correct me if I am wrong -
>>
>> ima_policy_flag will be set to 0 if IMA is not yet initialized
>> OR
>> IMA is initialized, but ima_policy_flag could be still set to 0 (say,
>> due to the configured policy).
>>
>> In the latter case the measurement request should be a NOP immediately.
>
> I'm not sure. The builtin keys most likely will be loaded prior to a
> custom IMA policy containing "keyring" rules are defined.
>
> Mimi
I am not sure if I described it clearly - let me clarify:
Say, we use ima_policy_flag to determine whether to
measure the key immediately or
queue the key for measurement and, measure when IMA is initialized.
We can incorrectly keep queuing keys in the case when IMA is
initialized, but due to the way IMA policy is configured ima_policy_flag
is still 0.
That's why I feel a separate boolean flag would be needed to know
whether IMA is initialized or not.
If IMA is initialized, ima_policy_flag will dictate whether to measure
the key or not.
thanks,
-lakshmi
next prev parent reply other threads:[~2019-10-28 14:58 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-23 23:39 [PATCH v2 0/4] KEYS: measure keys when they are created or updated Lakshmi Ramasubramanian
2019-10-23 23:39 ` [PATCH v2 1/4] KEYS: Defined an ima hook for measuring keys on key create or update Lakshmi Ramasubramanian
2019-10-25 19:40 ` Mimi Zohar
2019-10-25 19:49 ` Lakshmi Ramasubramanian
2019-10-25 22:28 ` Lakshmi Ramasubramanian
2019-10-27 14:47 ` Mimi Zohar
2019-10-28 14:58 ` Lakshmi Ramasubramanian [this message]
2019-10-23 23:39 ` [PATCH v2 2/4] KEYS: Queue key for measurement if ima is not initialized. Measure queued keys when ima is initialized Lakshmi Ramasubramanian
2019-10-23 23:39 ` [PATCH v2 3/4] KEYS: Added BUILTIN_TRUSTED_KEYS enum to measure keys added to builtin_trusted_keys keyring Lakshmi Ramasubramanian
2019-10-27 14:33 ` Mimi Zohar
2019-10-28 15:12 ` Lakshmi Ramasubramanian
2019-10-28 17:08 ` Mimi Zohar
2019-10-28 15:56 ` Lakshmi Ramasubramanian
2019-10-23 23:39 ` [PATCH v2 4/4] KEYS: Enabled ima policy " Lakshmi Ramasubramanian
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1d7730ff-9847-c6be-4f4f-8cf1e90a71f2@linux.microsoft.com \
--to=nramas@linux.microsoft.com \
--cc=casey@schaufler-ca.com \
--cc=dhowells@redhat.com \
--cc=jamorris@linux.microsoft.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).