Messages in this thread | | | Subject | Re: [PATCH v9 5/8] ima: make process_buffer_measurement() generic | From | Lakshmi Ramasubramanian <> | Date | Wed, 30 Oct 2019 08:22:02 -0700 |
| |
On 10/23/19 8:47 PM, Nayna Jain wrote:
Hi Nayna,
> process_buffer_measurement() is limited to measuring the kexec boot > command line. This patch makes process_buffer_measurement() more > generic, allowing it to measure other types of buffer data (e.g. > blacklisted binary hashes or key hashes).
Now that process_buffer_measurement() is being made generic to measure any buffer, it would be good to add a tag to indicate what type of buffer is being measured.
For example, if the buffer is kexec command line the log could look like:
"kexec_cmdline: <command line data>"
Similarly, if the buffer is blacklisted binary hash:
"blacklist hash: <data>".
If the buffer is key hash:
"<name of the keyring>: key data".
This would greatly help the consumer of the IMA log to know the type of data represented in each IMA log entry.
thanks, -lakshmi
| |