Re: [USER] [PATCH 2/2] Add security.apparmor to the set of extended attributes used by EVM

[Mimi Zohar <zohar@linux.vnet.ibm.com>]

On Thu, 2018-06-14 at 16:41 -0400, Mimi Zohar wrote:
> On Thu, 2018-06-14 at 12:43 -0700, Matthew Garrett wrote:
> > On Tue, Jun 12, 2018 at 4:42 PM Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> > >
> > > On Tue, 2018-04-17 at 15:56 -0700, Matthew Garrett wrote:
> > > > The kernel is taking security.apparmor into account when validating EVM,
> > > > so evmctl should be doing the same.
> > > >
> > > > Signed-off-by: Matthew Garrett <mjg59@google.com>
> > >
> > > The XATTR_NAME_APPARMOR is dependent on the version of
> > > "/usr/include/linux/xattr.h".  Without it defined, evmctl fails to
> > > build.
> > 
> > Hmm, true. Is it reasonable to just hardcode it rather than using the define?
> 
> I'm not sure how difficult it would be to tie the package name/version
> to a specific kernel release.  Commit 096b85464832 ("EVM: Include
> security.apparmor in EVM measurements") was upstreamed in linux-4.15.

Instead, I've made the following change and pushed it out to master.

+#ifndef XATTR_APPAARMOR_SUFFIX
+#define XATTR_APPARMOR_SUFFIX "apparmor"
+#define XATTR_NAME_APPARMOR XATTR_SECURITY_PREFIX XATTR_APPARMOR_SUFFIX
+#endif
+

thanks,

Mimi