Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files
@ 2019-07-27  3:18 Vitaly Chikunov
  2019-07-27  3:19 ` [PATCH 2/2] ima-evm-utils: Never exit with -1 code Vitaly Chikunov
  2019-07-30 11:42 ` [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files Mimi Zohar
  0 siblings, 2 replies; 6+ messages in thread
From: Vitaly Chikunov @ 2019-07-27  3:18 UTC (permalink / raw)
  To: Mimi Zohar, Dmitry Kasatkin, linux-integrity

If any tested file results in failure produce failure exit code.
Previously exit code affected only by the last file tested.

Fixes: "Allow multiple files in ima_verify"
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---

I decided not to rebase "Allow multiple files in ima_verify" to not create
merge conflicts with "Namespace some too generic object names".

 src/evmctl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/evmctl.c b/src/evmctl.c
index b02be8b..d33a91e 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -887,7 +887,7 @@ static int verify_ima(const char *file)
 static int cmd_verify_ima(struct command *cmd)
 {
 	char *file = g_argv[optind++];
-	int err;
+	int err, fails = 0;
 
 	if (imaevm_params.keyfile)	/* Support multiple public keys */
 		init_public_keys(imaevm_params.keyfile);
@@ -903,10 +903,12 @@ static int cmd_verify_ima(struct command *cmd)
 
 	do {
 		err = verify_ima(file);
+		if (err)
+			fails++;
 		if (!err && imaevm_params.verbose >= LOG_INFO)
 			log_info("%s: verification is OK\n", file);
 	} while ((file = g_argv[optind++]));
-	return err;
+	return fails > 0;
 }
 
 static int cmd_convert(struct command *cmd)
-- 
2.11.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH 2/2] ima-evm-utils: Never exit with -1 code
  2019-07-27  3:18 [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files Vitaly Chikunov
@ 2019-07-27  3:19 ` Vitaly Chikunov
  2019-07-30 11:57   ` Mimi Zohar
  2019-07-30 11:42 ` [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files Mimi Zohar
  1 sibling, 1 reply; 6+ messages in thread
From: Vitaly Chikunov @ 2019-07-27  3:19 UTC (permalink / raw)
  To: Mimi Zohar, Dmitry Kasatkin, linux-integrity

Change main() return code from -1 to 125 as -1 is not really valid exit
code. 125 is choosen because exit codes for signals start from 126.

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---
 src/evmctl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/evmctl.c b/src/evmctl.c
index d33a91e..e0a835f 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -2100,6 +2100,8 @@ int main(int argc, char *argv[])
 				break;
 			log_err("%s\n", ERR_error_string(error, NULL));
 		}
+		if (err < 0)
+			err = 125;
 	}
 
 	if (eng) {
-- 
2.11.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files
  2019-07-27  3:18 [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files Vitaly Chikunov
  2019-07-27  3:19 ` [PATCH 2/2] ima-evm-utils: Never exit with -1 code Vitaly Chikunov
@ 2019-07-30 11:42 ` Mimi Zohar
  1 sibling, 0 replies; 6+ messages in thread
From: Mimi Zohar @ 2019-07-30 11:42 UTC (permalink / raw)
  To: Vitaly Chikunov, Dmitry Kasatkin, linux-integrity

On Sat, 2019-07-27 at 06:18 +0300, Vitaly Chikunov wrote:
> If any tested file results in failure produce failure exit code.
> Previously exit code affected only by the last file tested.
> 
> Fixes: "Allow multiple files in ima_verify"
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> ---
> 
> I decided not to rebase "Allow multiple files in ima_verify" to not create
> merge conflicts with "Namespace some too generic object names".

This is fine, thanks.

Mimi

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 2/2] ima-evm-utils: Never exit with -1 code
  2019-07-27  3:19 ` [PATCH 2/2] ima-evm-utils: Never exit with -1 code Vitaly Chikunov
@ 2019-07-30 11:57   ` Mimi Zohar
  2019-07-30 12:29     ` Vitaly Chikunov
  0 siblings, 1 reply; 6+ messages in thread
From: Mimi Zohar @ 2019-07-30 11:57 UTC (permalink / raw)
  To: Vitaly Chikunov, Dmitry Kasatkin, linux-integrity

On Sat, 2019-07-27 at 06:19 +0300, Vitaly Chikunov wrote:
> Change main() return code from -1 to 125 as -1 is not really valid exit
> code. 125 is choosen because exit codes for signals start from 126.
> 
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> ---
>  src/evmctl.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/src/evmctl.c b/src/evmctl.c
> index d33a91e..e0a835f 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -2100,6 +2100,8 @@ int main(int argc, char *argv[])
>  				break;
>  			log_err("%s\n", ERR_error_string(error, NULL));
>  		}
> +		if (err < 0)
> +			err = 125;
>  	}
>  
>  	if (eng) {

Agreed we need to return better errors, but instead of always
returning 125, would it be better to return the first errno, if err is
-1?

Mimi

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 2/2] ima-evm-utils: Never exit with -1 code
  2019-07-30 11:57   ` Mimi Zohar
@ 2019-07-30 12:29     ` Vitaly Chikunov
  2019-07-30 12:39       ` Vitaly Chikunov
  0 siblings, 1 reply; 6+ messages in thread
From: Vitaly Chikunov @ 2019-07-30 12:29 UTC (permalink / raw)
  To: Mimi Zohar; +Cc: Dmitry Kasatkin, linux-integrity

Mimi,

On Tue, Jul 30, 2019 at 07:57:10AM -0400, Mimi Zohar wrote:
> On Sat, 2019-07-27 at 06:19 +0300, Vitaly Chikunov wrote:
> > Change main() return code from -1 to 125 as -1 is not really valid exit
> > code. 125 is choosen because exit codes for signals start from 126.
> > 
> > Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> > ---
> >  src/evmctl.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/src/evmctl.c b/src/evmctl.c
> > index d33a91e..e0a835f 100644
> > --- a/src/evmctl.c
> > +++ b/src/evmctl.c
> > @@ -2100,6 +2100,8 @@ int main(int argc, char *argv[])
> >  				break;
> >  			log_err("%s\n", ERR_error_string(error, NULL));
> >  		}
> > +		if (err < 0)
> > +			err = 125;
> >  	}
> >  
> >  	if (eng) {
> 
> Agreed we need to return better errors, but instead of always
> returning 125, would it be better to return the first errno, if err is
> -1?

125 will be not always but only to avoid returning -1 (or any negative).

There is no practice to exit with errno, AFAIK. Plus, errno we have at
the end (and which is reported to user) frequently is bogus and that
should be fixed. (I may do this later maybe, don't know how much work
that would require).

We also wish to reserve some exit code as hard error for tests.

Thanks,

> 
> Mimi

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 2/2] ima-evm-utils: Never exit with -1 code
  2019-07-30 12:29     ` Vitaly Chikunov
@ 2019-07-30 12:39       ` Vitaly Chikunov
  0 siblings, 0 replies; 6+ messages in thread
From: Vitaly Chikunov @ 2019-07-30 12:39 UTC (permalink / raw)
  To: Mimi Zohar, Dmitry Kasatkin, linux-integrity

On Tue, Jul 30, 2019 at 03:29:39PM +0300, Vitaly Chikunov wrote:
> On Tue, Jul 30, 2019 at 07:57:10AM -0400, Mimi Zohar wrote:
> > On Sat, 2019-07-27 at 06:19 +0300, Vitaly Chikunov wrote:
> > > +		if (err < 0)
> > > +			err = 125;
> > >  	}
> > >  
> > >  	if (eng) {
> > 
> > Agreed we need to return better errors, but instead of always
> > returning 125, would it be better to return the first errno, if err is
> > -1?
> 
> 125 will be not always but only to avoid returning -1 (or any negative).
> 
> There is no practice to exit with errno, AFAIK. Plus, errno we have at
> the end (and which is reported to user) frequently is bogus and that
> should be fixed. (I may do this later maybe, don't know how much work
> that would require).
> 
> We also wish to reserve some exit code as hard error for tests.

I meant 'we also may wish'... This needs to be thought over.


^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, back to index

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-27  3:18 [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files Vitaly Chikunov
2019-07-27  3:19 ` [PATCH 2/2] ima-evm-utils: Never exit with -1 code Vitaly Chikunov
2019-07-30 11:57   ` Mimi Zohar
2019-07-30 12:29     ` Vitaly Chikunov
2019-07-30 12:39       ` Vitaly Chikunov
2019-07-30 11:42 ` [PATCH 1/2] ima-evm-utils: Fix ima_verify return value on multiple files Mimi Zohar

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org linux-integrity@archiver.kernel.org
	public-inbox-index linux-integrity


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/ public-inbox