Re: [PATCH V3] IMA: Allow profiles to define the desired IMA template

[Mimi Zohar <zohar@linux.ibm.com>]

On Tue, 2019-06-04 at 13:03 -0700, Matthew Garrett wrote:
> On Mon, Jun 3, 2019 at 6:52 PM Mimi Zohar <zohar@linux.ibm.com> wrote:
> > On Mon, 2019-06-03 at 13:13 -0700, Matthew Garrett wrote:
> > > +                     template:= name or format of a defined IMA template
> > > +                     type (eg,ima-ng or d-ng|n-ng). Only valid when action
> > > +                     is "measure".
> >
> > This patch only supports specifying the template name, not the
> > template format description.  Please remove "d-ng|n-ng".
> 
> It supports specifying the template format, as long as the template
> format is already defined. I can remove the example, but it'll still
> work.

Correct, as mentioned in subsequent posts.  Until full support for
template field descriptions is added, please remove the field format
example.

> 
> > >       struct ima_rule_entry *entry;
> > >       int action = 0, actmask = flags | (flags << 1);
> > > @@ -438,6 +441,11 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
> > >               if ((pcr) && (entry->flags & IMA_PCR))
> > >                       *pcr = entry->pcr;
> > >
> > > +             if (template_desc && entry->template)
> > > +                     *template_desc = entry->template;
> > > +             else
> > > +                     *template_desc = ima_template_desc_current();
> > > +
> >
> > This code is finding the template format, but is subsequently being
> > replaced with the current description.  One way of fixing this, is by
> > initializing the template_desc before walking the list.
> 
> Ok

Subsequent posts pointed out that either all callers to
ima_match_policy() need to pass a pointer to template_desc or
*template_desc needs to be tested.

thanks!

Mimi