Messages in this thread | | | Subject | Re: [PATCH v4 01/10] IMA: Defined an IMA hook to measure keys on key create or update | From | Lakshmi Ramasubramanian <> | Date | Wed, 6 Nov 2019 16:21:43 -0800 |
| |
On 11/6/2019 2:43 PM, Mimi Zohar wrote:
>> +void ima_post_key_create_or_update(struct key *keyring, struct key *key, >> + unsigned long flags, bool create) >> +{ >> + if ((keyring != NULL) && (key != NULL)) >> + return; > > I would move the patch that defines the "keyring=" policy option prior > to this one. Include the call to process_buffer_measurement() in this > patch. A subsequent patch would add support to defer measuring the > key, by calling a function named something like > ima_queue_key_measurement(). > > Mimi
As I'd stated in the other response, I wanted to isolate all key related code in a separate C file and build it if and only if all CONFIG dependencies are met.
I can do the following:
=> Define the IMA hook in ima_asymmetric_keys.c instead of ima_main.c
=> In include/linux/ima.h declare the IMA hook if CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS is enabled. Else, NOP it.
#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS extern void ima_post_key_create_or_update(struct key *keyring, struct key *key, unsigned long flags, bool create); #else static inline void ima_post_key_create_or_update(struct key *keyring, struct key *key, unsigned long flags, bool create) {} #endif
Would that be acceptable?
thanks, -lakshmi
| |