From: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: linux-security-module@vger.kernel.org,
linux-ima-devel@lists.sourceforge.net, keyrings@vger.kernel.org,
linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
David Howells <dhowells@redhat.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Claudio Carvalho <cclaudio@linux.vnet.ibm.com>
Subject: Re: [PATCH 3/6] ima: Simplify policy_func_show.
Date: Mon, 24 Apr 2017 14:14:05 -0300 [thread overview]
Message-ID: <9111285.IvmltpgZRA@morokweng> (raw)
In-Reply-To: <1492783076.3081.202.camel@linux.vnet.ibm.com>
Am Freitag, 21. April 2017, 09:57:56 BRT schrieb Mimi Zohar:
> On Thu, 2017-04-20 at 17:40 -0300, Thiago Jung Bauermann wrote:
> > @@ -949,49 +936,16 @@ void ima_policy_stop(struct seq_file *m, void *v)
> >
> > #define pt(token) policy_tokens[token + Opt_err].pattern
> > #define mt(token) mask_tokens[token]
> >
> > -#define ft(token) func_tokens[token]
> >
> > /*
> >
> > * policy_func_show - display the ima_hooks policy rule
> > */
> >
> > static void policy_func_show(struct seq_file *m, enum ima_hooks func)
> > {
> >
> > - char tbuf[64] = {0,};
> > -
> > - switch (func) {
> > - case FILE_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_file));
> > - break;
> > - case MMAP_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_mmap));
> > - break;
> > - case BPRM_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_bprm));
> > - break;
> > - case MODULE_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_module));
> > - break;
> > - case FIRMWARE_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_firmware));
> > - break;
> > - case POST_SETATTR:
> > - seq_printf(m, pt(Opt_func), ft(func_post));
> > - break;
> > - case KEXEC_KERNEL_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_kexec_kernel));
> > - break;
> > - case KEXEC_INITRAMFS_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_kexec_initramfs));
> > - break;
> > - case POLICY_CHECK:
> > - seq_printf(m, pt(Opt_func), ft(func_policy));
> > - break;
> > - default:
> > - snprintf(tbuf, sizeof(tbuf), "%d", func);
> > - seq_printf(m, pt(Opt_func), tbuf);
> > - break;
> > - }
> > - seq_puts(m, " ");
> > + if (func > 0 && func < MAX_CHECK)
> > + seq_printf(m, "func=%s ", func_tokens[func]);
> > + else
> > + seq_printf(m, "func=%d ", func);
>
> The only time this can happen is when __kernel_read_file_id() is
> updated without updating the read_idmap[]. Perhaps we can display the
> number and the appropriate __kernel_read_file_id string.
>From what I understood of the code func comes from ima_parse_rule, so that
condition would only happen if ima_parse_rule got out of sync with
func_tokens. Since that code only initializes func with constants from enum
ima_hooks and this patch makes ima_hooks automatically sync with func_tokens,
the else branch is more like a "can't happen" safety net.
read_idmap is only used in ima_post_read_file, and I couldn't see a relation
between that code path and the one for ima_policy_show.
--
Thiago Jung Bauermann
IBM Linux Technology Center
next prev parent reply other threads:[~2017-04-24 17:14 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-18 20:17 [PATCH 0/6] Appended signatures support for IMA appraisal Thiago Jung Bauermann
2017-04-18 20:17 ` [PATCH 1/6] integrity: Small code improvements Thiago Jung Bauermann
2017-04-18 20:17 ` [PATCH 2/6] ima: Tidy up constant strings Thiago Jung Bauermann
2017-04-18 20:17 ` [PATCH 3/6] ima: Simplify policy_func_show Thiago Jung Bauermann
2017-04-20 12:13 ` Mimi Zohar
2017-04-20 20:40 ` Thiago Jung Bauermann
2017-04-21 13:57 ` Mimi Zohar
2017-04-24 17:14 ` Thiago Jung Bauermann [this message]
2017-04-18 20:17 ` [PATCH 4/6] ima: Log the same audit cause whenever a file has no signature Thiago Jung Bauermann
2017-04-18 20:17 ` [PATCH 5/6] MODSIGN: Export module signature definitions Thiago Jung Bauermann
2017-04-20 12:35 ` Mimi Zohar
2017-04-20 14:37 ` David Howells
2017-04-20 21:07 ` Thiago Jung Bauermann
2017-04-18 20:17 ` [PATCH 6/6] ima: Support appended signatures for appraisal Thiago Jung Bauermann
2017-04-20 3:04 ` kbuild test robot
2017-04-20 23:41 ` Thiago Jung Bauermann
2017-04-26 22:18 ` Mehmet Kayaalp
2017-04-27 21:41 ` Thiago Jung Bauermann
2017-04-27 22:17 ` Mehmet Kayaalp
2017-04-26 11:21 ` Mimi Zohar
2017-04-26 20:40 ` Thiago Jung Bauermann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9111285.IvmltpgZRA@morokweng \
--to=bauerman@linux.vnet.ibm.com \
--cc=cclaudio@linux.vnet.ibm.com \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=herbert@gondor.apana.org.au \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-ima-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).