lkml.org 
[lkml]   [2019]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v9 7/8] ima: check against blacklisted hashes for files with modsig
From
Date
On 10/23/2019 8:47 PM, Nayna Jain wrote:

> +/*
> + * ima_check_blacklist - determine if the binary is blacklisted.
> + *
> + * Add the hash of the blacklisted binary to the measurement list, based
> + * on policy.
> + *
> + * Returns -EPERM if the hash is blacklisted.
> + */
> +int ima_check_blacklist(struct integrity_iint_cache *iint,
> + const struct modsig *modsig, int pcr)
> +{
> + enum hash_algo hash_algo;
> + const u8 *digest = NULL;
> + u32 digestsize = 0;
> + int rc = 0;
> +
> + if (!(iint->flags & IMA_CHECK_BLACKLIST))
> + return 0;
> +
> + if (iint->flags & IMA_MODSIG_ALLOWED && modsig) {
> + ima_get_modsig_digest(modsig, &hash_algo, &digest, &digestsize);
> +
> + rc = is_binary_blacklisted(digest, digestsize);
> + if ((rc == -EPERM) && (iint->flags & IMA_MEASURE))
> + process_buffer_measurement(digest, digestsize,
> + "blacklisted-hash", NONE,
> + pcr);
> + }

The enum value "NONE" is being passed to process_buffer_measurement to
indicate that the check for required action based on ima policy is
already done by ima_check_blacklist. Not sure, but this can cause
confusion in the future when someone updates process_buffer_measurement.

Would it instead be better to add another parameter to
process_buffer_measurement to indicate the above condition?

-lakshmi

\
 
 \ /
  Last update: 2019-10-24 19:49    [W:0.181 / U:0.952 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site