Messages in this thread Patch in this message | | | Date | Wed, 19 Jan 2022 07:23:17 -0500 | Subject | Re: [PATCH v8 05/19] ima: Move measurement list related variables into ima_namespace | From | Stefan Berger <> |
| |
On 1/13/22 15:27, Mimi Zohar wrote: > Hi Stefan, > > On Tue, 2022-01-04 at 12:04 -0500, Stefan Berger wrote: >> From: Stefan Berger <stefanb@linux.ibm.com> >> >> Move measurement list related variables into the ima_namespace. This way a >> front-end like SecurityFS can show the measurement list inside an IMA >> namespace. >> >> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> >> --- >> security/integrity/ima/ima.h | 5 +++-- >> security/integrity/ima/ima_fs.c | 6 ++++-- >> security/integrity/ima/ima_init_ima_ns.c | 5 +++++ >> security/integrity/ima/ima_kexec.c | 12 +++++++----- >> security/integrity/ima/ima_queue.c | 24 ++++++++++-------------- >> 5 files changed, 29 insertions(+), 23 deletions(-) >> >> diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h >> index 68d8a8e6fd1d..ee16ce5050c8 100644 >> --- a/security/integrity/ima/ima.h >> +++ b/security/integrity/ima/ima.h >> @@ -106,7 +106,6 @@ struct ima_queue_entry { >> struct list_head later; /* place in ima_measurements list */ >> struct ima_template_entry *entry; >> }; >> -extern struct list_head ima_measurements; /* list of all measurements */ >> >> /* Some details preceding the binary serialized measurement list */ >> struct ima_kexec_hdr { >> @@ -134,6 +133,8 @@ struct ima_namespace { >> int ima_policy_flag; >> >> struct ima_h_table ima_htable; >> + struct list_head ima_measurements; >> + unsigned long binary_runtime_size; > Please add a comment indicating binary_runtime_size is only applicable > to ns_ima_init.
It looks like this now:
struct list_head ima_measurements; /* binary_runtime_size is used only by init_ima_ns */ unsigned long binary_runtime_size;
> > >> } __randomize_layout; >> extern struct ima_namespace init_ima_ns; > >> @@ -124,12 +119,13 @@ static int ima_add_digest_entry(struct ima_namespace *ns, >> * entire binary_runtime_measurement list, including the ima_kexec_hdr >> * structure. >> */ >> -unsigned long ima_get_binary_runtime_size(void) >> +unsigned long ima_get_binary_runtime_size(struct ima_namespace *ns) >> { >> - if (binary_runtime_size >= (ULONG_MAX - sizeof(struct ima_kexec_hdr))) >> + if (ns->binary_runtime_size >= >> + (ULONG_MAX - sizeof(struct ima_kexec_hdr))) >> return ULONG_MAX; >> else >> - return binary_runtime_size + sizeof(struct ima_kexec_hdr); >> + return ns->binary_runtime_size + sizeof(struct ima_kexec_hdr); >> } >> > Please update the function description indicating that either carrying > the measurement list across kexec is limited to ns_ima_init or not > supported by namespaces.
This is the updated function description:
/* * Return the amount of memory required for serializing the * entire binary_runtime_measurement list, including the ima_kexec_hdr * structure. Carrying the measurement list across kexec is limited * to init_ima_ns. */ > > thanks, > > Mimi >
| |