Messages in this thread | | | Date | Wed, 26 Jan 2022 17:23:49 -0500 | Subject | Re: [PATCH v9 08/23] ima: Move measurement list related variables into ima_namespace | From | Stefan Berger <> |
| |
On 1/26/22 04:21, Christian Brauner wrote: > On Tue, Jan 25, 2022 at 05:46:30PM -0500, Stefan Berger wrote: >> From: Stefan Berger <stefanb@linux.ibm.com> >> >> Move measurement list related variables into the ima_namespace. This way >> a front-end like securityfs can show the measurement list inside an IMA >> namespace. >> >> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> >> --- >> security/integrity/ima/ima.h | 5 +++-- >> security/integrity/ima/ima_fs.c | 6 ++++-- >> security/integrity/ima/ima_init_ima_ns.c | 5 +++++ >> security/integrity/ima/ima_kexec.c | 12 ++++++----- >> security/integrity/ima/ima_queue.c | 27 +++++++++++------------- >> 5 files changed, 31 insertions(+), 24 deletions(-) >> >> diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h >> index 340a59174670..45706836a77b 100644 >> --- a/security/integrity/ima/ima.h >> +++ b/security/integrity/ima/ima.h >> @@ -106,7 +106,6 @@ struct ima_queue_entry { >> struct list_head later; /* place in ima_measurements list */ >> struct ima_template_entry *entry; >> }; >> -extern struct list_head ima_measurements; /* list of all measurements */ >> >> /* Some details preceding the binary serialized measurement list */ >> struct ima_kexec_hdr { >> @@ -136,6 +135,8 @@ struct ima_namespace { >> struct ima_rule_entry *arch_policy_entry; >> >> struct ima_h_table ima_htable; >> + struct list_head ima_measurements; /* list of all measurements */ >> + unsigned long binary_runtime_size; /* used by init_ima_ns */ >> } __randomize_layout; > Moving this into struct imans seems sane to me but I'm not going to ack > it because I don't have enough knowledge to guarantee that this code > will only run for init_ima_ns. I'll leave that to Mimi.
The code modifying binary_runtime_size may do this for all IMA namespaces but the resulting value of binary_runtime_size may only matter in init_ima_ns (not 100% sure, but Mimi seems to say so). Moving it into ima_namespace rather than special-casing the code keeps the code readable.
There are also some case in the code that may do something like this:
if (ns == &init_ima_ns)
foo = xyz;
Those will go away when foo is moved into the namespace and then it becomes ns->foo = xyz, which is much saner for readability but unavoidable for some variables at this stage.
| |