From: Mimi Zohar <zohar@linux.ibm.com>
To: Scott Branden <scott.branden@broadcom.com>,
Kees Cook <keescook@chromium.org>
Cc: Christoph Hellwig <hch@infradead.org>,
Luis Chamberlain <mcgrof@kernel.org>,
viro@zeniv.linux.org.uk, gregkh@linuxfoundation.org,
rafael@kernel.org, ebiederm@xmission.com, jeyu@kernel.org,
jmorris@namei.org, paul@paul-moore.com,
stephen.smalley.work@gmail.com, eparis@parisplace.org,
nayna@linux.ibm.com, dan.carpenter@oracle.com,
skhan@linuxfoundation.org, geert@linux-m68k.org,
tglx@linutronix.de, bauerman@linux.ibm.com, dhowells@redhat.com,
linux-integrity@vger.kernel.org, linux-fsdevel@vger.kernel.org,
kexec@lists.infradead.org, linux-security-module@vger.kernel.org,
selinux@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/3] fs: reduce export usage of kerne_read*() calls
Date: Fri, 05 Jun 2020 14:37:18 -0400 [thread overview]
Message-ID: <1591382238.5816.27.camel@linux.ibm.com> (raw)
In-Reply-To: <1c68c0c7-1b0a-dfec-0e50-1b65eedc3dc7@broadcom.com>
On Fri, 2020-06-05 at 11:15 -0700, Scott Branden wrote:
> Hi Mimi,
>
> On 2020-05-23 7:52 p.m., Mimi Zohar wrote:
> > Scott, the change should be straight forward. The additional patch
> > needs to:
> > - define a new kernel_read_file_id enumeration, like
> > FIRMWARE_PARTIAL_READ.
> > - Currently ima_read_file() has a comment about pre-allocated firmware
> > buffers. Update ima_read_file() to call process_measurement() for the
> > new enumeration FIRMWARE_PARTIAL_READ and update ima_post_read_file()
> > to return immediately.
> Should this be what is in ima_read_file?
> {
> enum ima_hooks func;
> u32 secid;
Please don't remove the existing comment.
> if (read_id != READING_FIRMWARE_PARTIAL_READ)
> return 0;
>
> if (!file) { /* should never happen */
> if (ima_appraise & IMA_APPRAISE_ENFORCE)
> return -EACCES;
> return 0;
> }
This checks for any IMA appraise rule. You want to enforce firmware
signature checking only if there is a firmware appraise rule. Refer
to ima_post_read_file().
> security_task_getsecid(current, &secid);
> return process_measurement(file, current_cred(), secid, NULL,
> 0, MAY_READ, FILE_CHECK);
The read_idmap enumeration should be updated similar to the other
firmware. Keep the code generic. Refer to ima_post_read_file().
func will be defined as FIRMWARE_CHECK.
thanks,
Mimi
prev parent reply other threads:[~2020-06-05 18:37 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-13 15:21 [PATCH 0/3] fs: reduce export usage of kerne_read*() calls Luis Chamberlain
2020-05-13 15:21 ` [PATCH 1/3] fs: unexport kernel_read_file() Luis Chamberlain
2020-05-13 15:21 ` [PATCH 2/3] security: add symbol namespace for reading file data Luis Chamberlain
2020-05-13 15:40 ` Eric W. Biederman
2020-05-13 16:09 ` Greg KH
2020-05-13 16:16 ` Luis Chamberlain
2020-05-13 16:26 ` Greg KH
2020-05-13 18:07 ` Josh Triplett
2020-05-13 15:21 ` [PATCH 3/3] fs: move kernel_read*() calls to its own symbol namespace Luis Chamberlain
2020-05-13 16:08 ` Greg KH
2020-05-13 18:17 ` [PATCH 0/3] fs: reduce export usage of kerne_read*() calls Christoph Hellwig
2020-05-15 21:29 ` Luis Chamberlain
2020-05-18 6:22 ` Christoph Hellwig
2020-05-18 12:37 ` Mimi Zohar
2020-05-18 15:21 ` Kees Cook
2020-07-29 1:20 ` Luis Chamberlain
2020-05-22 22:24 ` Scott Branden
2020-05-22 23:04 ` Kees Cook
2020-05-22 23:25 ` Scott Branden
2020-05-24 2:52 ` Mimi Zohar
2020-06-05 18:15 ` Scott Branden
2020-06-05 18:37 ` Mimi Zohar [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1591382238.5816.27.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=bauerman@linux.ibm.com \
--cc=dan.carpenter@oracle.com \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=eparis@parisplace.org \
--cc=geert@linux-m68k.org \
--cc=gregkh@linuxfoundation.org \
--cc=hch@infradead.org \
--cc=jeyu@kernel.org \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kexec@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mcgrof@kernel.org \
--cc=nayna@linux.ibm.com \
--cc=paul@paul-moore.com \
--cc=rafael@kernel.org \
--cc=scott.branden@broadcom.com \
--cc=selinux@vger.kernel.org \
--cc=skhan@linuxfoundation.org \
--cc=stephen.smalley.work@gmail.com \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).