Linux-Integrity Archive on lore.kernel.org
 help / Atom feed
* Re: linux-next: Tree for Dec 14 (security/integrity/ima/)
       [not found] <20181214181826.5775b958@canb.auug.org.au>
@ 2018-12-14 16:25 ` Randy Dunlap
  2018-12-14 19:19   ` Mimi Zohar
  0 siblings, 1 reply; 5+ messages in thread
From: Randy Dunlap @ 2018-12-14 16:25 UTC (permalink / raw)
  To: Stephen Rothwell, Linux Next Mailing List
  Cc: Linux Kernel Mailing List, linux-integrity

On 12/13/18 11:18 PM, Stephen Rothwell wrote:
> Hi all,
> 
> Changes since 20181213:
> 

on i386:

  CC      security/integrity/ima/ima_main.o
../security/integrity/ima/ima_main.c: In function 'ima_load_data':
../security/integrity/ima/ima_main.c:535:3: error: implicit declaration of function 'is_module_sig_enforced' [-Werror=implicit-function-declaration]
   sig_enforce = is_module_sig_enforced();
   ^


Needs:

---
 security/integrity/ima/ima_main.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-next-20181214.orig/security/integrity/ima/ima_main.c
+++ linux-next-20181214/security/integrity/ima/ima_main.c
@@ -24,6 +24,7 @@
 #include <linux/init.h>
 #include <linux/file.h>
 #include <linux/binfmts.h>
+#include <linux/module.h>
 #include <linux/mount.h>
 #include <linux/mman.h>
 #include <linux/slab.h>



-- 
~Randy

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: linux-next: Tree for Dec 14 (security/integrity/ima/)
  2018-12-14 16:25 ` linux-next: Tree for Dec 14 (security/integrity/ima/) Randy Dunlap
@ 2018-12-14 19:19   ` Mimi Zohar
  2018-12-14 20:26     ` Paul Gortmaker
  0 siblings, 1 reply; 5+ messages in thread
From: Mimi Zohar @ 2018-12-14 19:19 UTC (permalink / raw)
  To: Randy Dunlap, Stephen Rothwell, Linux Next Mailing List, Paul Gortmaker
  Cc: Linux Kernel Mailing List, linux-integrity, James Morris

[Cc'ing Paul Gortmaker]

On Fri, 2018-12-14 at 08:25 -0800, Randy Dunlap wrote:
> On 12/13/18 11:18 PM, Stephen Rothwell wrote:
> > Hi all,
> > 
> > Changes since 20181213:
> > 
> 
> on i386:
> 
>   CC      security/integrity/ima/ima_main.o
> ../security/integrity/ima/ima_main.c: In function 'ima_load_data':
> ../security/integrity/ima/ima_main.c:535:3: error: implicit declaration of function 'is_module_sig_enforced' [-Werror=implicit-function-declaration]
>    sig_enforce = is_module_sig_enforced();
>    ^
> 
> 
> Needs:

Commit 4f83d5ea643a ("security: integrity: make ima_main explicitly
non-modular") just removed module.h.

Mimi 


> 
> ---
>  security/integrity/ima/ima_main.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> --- linux-next-20181214.orig/security/integrity/ima/ima_main.c
> +++ linux-next-20181214/security/integrity/ima/ima_main.c
> @@ -24,6 +24,7 @@
>  #include <linux/init.h>
>  #include <linux/file.h>
>  #include <linux/binfmts.h>
> +#include <linux/module.h>
>  #include <linux/mount.h>
>  #include <linux/mman.h>
>  #include <linux/slab.h>
> 
> 
> 


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: linux-next: Tree for Dec 14 (security/integrity/ima/)
  2018-12-14 19:19   ` Mimi Zohar
@ 2018-12-14 20:26     ` Paul Gortmaker
  2018-12-14 22:28       ` Paul Gortmaker
  0 siblings, 1 reply; 5+ messages in thread
From: Paul Gortmaker @ 2018-12-14 20:26 UTC (permalink / raw)
  To: Mimi Zohar
  Cc: Randy Dunlap, Stephen Rothwell, Linux Next Mailing List,
	Linux Kernel Mailing List, linux-integrity, James Morris

[Re: linux-next: Tree for Dec 14 (security/integrity/ima/)] On 14/12/2018 (Fri 14:19) Mimi Zohar wrote:

> [Cc'ing Paul Gortmaker]
> 
> On Fri, 2018-12-14 at 08:25 -0800, Randy Dunlap wrote:
> > On 12/13/18 11:18 PM, Stephen Rothwell wrote:
> > > Hi all,
> > > 
> > > Changes since 20181213:
> > > 
> > 
> > on i386:
> > 
> >   CC      security/integrity/ima/ima_main.o
> > ../security/integrity/ima/ima_main.c: In function 'ima_load_data':
> > ../security/integrity/ima/ima_main.c:535:3: error: implicit declaration of function 'is_module_sig_enforced' [-Werror=implicit-function-declaration]
> >    sig_enforce = is_module_sig_enforced();
> >    ^
> > 
> > 
> > Needs:
> 
> Commit 4f83d5ea643a ("security: integrity: make ima_main explicitly
> non-modular") just removed module.h.

Yes, unfortunately the security directory has additional confusion
because there is name space overlap between "module" as used in Linux
Security Module, and "module" as in "insmod foo.ko".  The ima_main
is not modular, but it does use modular infrastructure to load others.

Fortunately this was the final commit in the series, so it can be
removed or reverted as per maintainer's choice.  In the meantime, I'll
look into why my "allyesconfig" build testing didn't pick up on this,
so I can close that testing gap.

Randy, if you were using one of your usual "randconfig" builds, maybe
you can mail me the .config out of band - no need spamming the lists.

Thanks, and sorry for the undetected fallout.
Paul.
--

> 
> Mimi 
> 
> 
> > 
> > ---
> >  security/integrity/ima/ima_main.c |    1 +
> >  1 file changed, 1 insertion(+)
> > 
> > --- linux-next-20181214.orig/security/integrity/ima/ima_main.c
> > +++ linux-next-20181214/security/integrity/ima/ima_main.c
> > @@ -24,6 +24,7 @@
> >  #include <linux/init.h>
> >  #include <linux/file.h>
> >  #include <linux/binfmts.h>
> > +#include <linux/module.h>
> >  #include <linux/mount.h>
> >  #include <linux/mman.h>
> >  #include <linux/slab.h>
> > 
> > 
> > 
> 

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: linux-next: Tree for Dec 14 (security/integrity/ima/)
  2018-12-14 20:26     ` Paul Gortmaker
@ 2018-12-14 22:28       ` Paul Gortmaker
  2018-12-20 18:00         ` James Morris
  0 siblings, 1 reply; 5+ messages in thread
From: Paul Gortmaker @ 2018-12-14 22:28 UTC (permalink / raw)
  To: Mimi Zohar, James Morris
  Cc: Randy Dunlap, Stephen Rothwell, Linux Next Mailing List,
	Linux Kernel Mailing List, linux-integrity, James Morris

[Re: linux-next: Tree for Dec 14 (security/integrity/ima/)] On 14/12/2018 (Fri 15:26) Paul Gortmaker wrote:

> [Re: linux-next: Tree for Dec 14 (security/integrity/ima/)] On 14/12/2018 (Fri 14:19) Mimi Zohar wrote:
> 
> > On Fri, 2018-12-14 at 08:25 -0800, Randy Dunlap wrote:
> > > 
> > > on i386:
> > > 
> > >   CC      security/integrity/ima/ima_main.o
> > > ../security/integrity/ima/ima_main.c: In function 'ima_load_data':
> > > ../security/integrity/ima/ima_main.c:535:3: error: implicit declaration of function 'is_module_sig_enforced' [-Werror=implicit-function-declaration]
> > >    sig_enforce = is_module_sig_enforced();
> > >    ^

[...]

> > Commit 4f83d5ea643a ("security: integrity: make ima_main explicitly
> > non-modular") just removed module.h.
> 
> Yes, unfortunately the security directory has additional confusion
> because there is name space overlap between "module" as used in Linux
> Security Module, and "module" as in "insmod foo.ko".  The ima_main
> is not modular, but it does use modular infrastructure to load others.
> 
> Fortunately this was the final commit in the series, so it can be
> removed or reverted as per maintainer's choice.  In the meantime, I'll
> look into why my "allyesconfig" build testing didn't pick up on this,
> so I can close that testing gap.

I've confirmed that most .config result in an implicit header presence
by looking at the CPP output.  Details below.

James, if your input branch to linux-next is strictly fast forward, here
is a partial revert to fix up what Randy found that you can apply.

Thanks for the report, and again - sorry for not detecting this myself.
Paul.
--

From 31081a8b46e84d64e2fbda8d0d82ba26d56cc468 Mon Sep 17 00:00:00 2001
From: Paul Gortmaker <paul.gortmaker@windriver.com>
Date: Fri, 14 Dec 2018 16:48:07 -0500
Subject: [PATCH] security: integrity: partial revert of make ima_main
 explicitly non-modular

In commit 4f83d5ea643a ("security: integrity: make ima_main explicitly
non-modular") I'd removed <linux/module.h> after assuming that the
function is_module_sig_enforced() was an LSM function and not a core
kernel module function.

Unfortunately the typical .config selections used in build testing
provide an implicit <linux/module.h> presence, and so normal/typical
build testing did not immediately reveal my incorrect assumption.

Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: James Morris <james.l.morris@oracle.com>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: linux-ima-devel@lists.sourceforge.net
Cc: linux-security-module@vger.kernel.org
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index adaf96932237..616a88f95b92 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -21,7 +21,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
-#include <linux/init.h>
+#include <linux/module.h>
 #include <linux/file.h>
 #include <linux/binfmts.h>
 #include <linux/mount.h>
-- 
2.7.4


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: linux-next: Tree for Dec 14 (security/integrity/ima/)
  2018-12-14 22:28       ` Paul Gortmaker
@ 2018-12-20 18:00         ` James Morris
  0 siblings, 0 replies; 5+ messages in thread
From: James Morris @ 2018-12-20 18:00 UTC (permalink / raw)
  To: Paul Gortmaker
  Cc: Mimi Zohar, Randy Dunlap, Stephen Rothwell,
	Linux Next Mailing List, Linux Kernel Mailing List,
	linux-integrity

On Fri, 14 Dec 2018, Paul Gortmaker wrote:

> >From 31081a8b46e84d64e2fbda8d0d82ba26d56cc468 Mon Sep 17 00:00:00 2001
> From: Paul Gortmaker <paul.gortmaker@windriver.com>
> Date: Fri, 14 Dec 2018 16:48:07 -0500
> Subject: [PATCH] security: integrity: partial revert of make ima_main
>  explicitly non-modular
> 
> In commit 4f83d5ea643a ("security: integrity: make ima_main explicitly
> non-modular") I'd removed <linux/module.h> after assuming that the
> function is_module_sig_enforced() was an LSM function and not a core
> kernel module function.
> 
> Unfortunately the typical .config selections used in build testing
> provide an implicit <linux/module.h> presence, and so normal/typical
> build testing did not immediately reveal my incorrect assumption.
> 
> Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
> Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
> Cc: James Morris <james.l.morris@oracle.com>
> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> Cc: linux-ima-devel@lists.sourceforge.net
> Cc: linux-security-module@vger.kernel.org
> Reported-by: Randy Dunlap <rdunlap@infradead.org>
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> 
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index adaf96932237..616a88f95b92 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -21,7 +21,7 @@
>  
>  #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
>  
> -#include <linux/init.h>
> +#include <linux/module.h>
>  #include <linux/file.h>
>  #include <linux/binfmts.h>
>  #include <linux/mount.h>
> 

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-general
and next-testing


-- 
James Morris
<jmorris@namei.org>


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, back to index

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20181214181826.5775b958@canb.auug.org.au>
2018-12-14 16:25 ` linux-next: Tree for Dec 14 (security/integrity/ima/) Randy Dunlap
2018-12-14 19:19   ` Mimi Zohar
2018-12-14 20:26     ` Paul Gortmaker
2018-12-14 22:28       ` Paul Gortmaker
2018-12-20 18:00         ` James Morris

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org linux-integrity@archiver.kernel.org
	public-inbox-index linux-integrity


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/ public-inbox