From: Mimi Zohar <zohar@linux.ibm.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
dhowells@redhat.com, casey@schaufler-ca.com, sashal@kernel.org,
jamorris@linux.microsoft.com,
linux-security-module@vger.kernel.org,
linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
keyrings@vger.kernel.org
Subject: Re: [PATCH v1 3/6] KEYS: ima hook to measure builtin_trusted_keys
Date: Wed, 23 Oct 2019 17:03:21 +0000 [thread overview]
Message-ID: <1571850201.5104.149.camel@linux.ibm.com> (raw)
In-Reply-To: <6a3f2efa-fc05-7bfd-368a-910dd4525f4c@linux.microsoft.com>
On Wed, 2019-10-23 at 07:49 -0700, Lakshmi Ramasubramanian wrote:
> On 10/23/19 6:22 AM, Mimi Zohar wrote:
>
> Thanks for reviewing the changes Mimi.
> I'll address your comments and post an updated patch set shortly.
>
> >> Add a new ima hook to measure keys added to builtin_trusted_keys
> >> keyring.
> >
> > There is no IMA hook in this patch.
> >
>
> >> + else if (strcmp(args[0].from,
> >> + "BUILTIN_TRUSTED_KEYS") = 0)
> >> + entry->func = BUILTIN_TRUSTED_KEYS;
> >> else
> >> result = -EINVAL;
> >> if (!result)
> >
> > Any new options need to be displayed as well.
>
> Not that I can think of. Please correct me if I am wrong.
True, since you're hard coding the policy.
WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
dhowells@redhat.com, casey@schaufler-ca.com, sashal@kernel.org,
jamorris@linux.microsoft.com,
linux-security-module@vger.kernel.org,
linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
keyrings@vger.kernel.org
Subject: Re: [PATCH v1 3/6] KEYS: ima hook to measure builtin_trusted_keys
Date: Wed, 23 Oct 2019 13:03:21 -0400 [thread overview]
Message-ID: <1571850201.5104.149.camel@linux.ibm.com> (raw)
In-Reply-To: <6a3f2efa-fc05-7bfd-368a-910dd4525f4c@linux.microsoft.com>
On Wed, 2019-10-23 at 07:49 -0700, Lakshmi Ramasubramanian wrote:
> On 10/23/19 6:22 AM, Mimi Zohar wrote:
>
> Thanks for reviewing the changes Mimi.
> I'll address your comments and post an updated patch set shortly.
>
> >> Add a new ima hook to measure keys added to builtin_trusted_keys
> >> keyring.
> >
> > There is no IMA hook in this patch.
> >
>
> >> + else if (strcmp(args[0].from,
> >> + "BUILTIN_TRUSTED_KEYS") == 0)
> >> + entry->func = BUILTIN_TRUSTED_KEYS;
> >> else
> >> result = -EINVAL;
> >> if (!result)
> >
> > Any new options need to be displayed as well.
>
> Not that I can think of. Please correct me if I am wrong.
True, since you're hard coding the policy.
next prev parent reply other threads:[~2019-10-23 17:03 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-23 0:18 [PATCH v1 0/6] KEYS: measure keys when they are created or updated Lakshmi Ramasubramanian
2019-10-23 0:18 ` Lakshmi Ramasubramanian
2019-10-23 0:18 ` [PATCH v1 1/6] KEYS: Helper function to check if the given keyring is builtin_trusted_keys Lakshmi Ramasubramanian
2019-10-23 0:18 ` Lakshmi Ramasubramanian
2019-10-23 0:18 ` [PATCH v1 2/6] KEYS: ima: Refactored process_buffer_measurement function so that it can measure any Lakshmi Ramasubramanian
2019-10-23 0:18 ` [PATCH v1 2/6] KEYS: ima: Refactored process_buffer_measurement function so that it can measure any buffer (and not just KEXEC_CMDLINE one) Lakshmi Ramasubramanian
2019-10-23 13:21 ` [PATCH v1 2/6] KEYS: ima: Refactored process_buffer_measurement function so that it can measure Mimi Zohar
2019-10-23 13:21 ` [PATCH v1 2/6] KEYS: ima: Refactored process_buffer_measurement function so that it can measure any buffer (and not just KEXEC_CMDLINE one) Mimi Zohar
2019-10-23 0:18 ` [PATCH v1 3/6] KEYS: ima hook to measure builtin_trusted_keys Lakshmi Ramasubramanian
2019-10-23 0:18 ` Lakshmi Ramasubramanian
2019-10-23 13:22 ` Mimi Zohar
2019-10-23 13:22 ` Mimi Zohar
2019-10-23 14:49 ` Lakshmi Ramasubramanian
2019-10-23 14:49 ` Lakshmi Ramasubramanian
2019-10-23 17:03 ` Mimi Zohar [this message]
2019-10-23 17:03 ` Mimi Zohar
2019-10-23 0:18 ` [PATCH v1 4/6] KEYS: ima functions to queue and dequeue keys to measure Lakshmi Ramasubramanian
2019-10-23 0:18 ` Lakshmi Ramasubramanian
2019-10-23 0:18 ` [PATCH v1 5/6] KEYS: measure queued keys Lakshmi Ramasubramanian
2019-10-23 0:18 ` Lakshmi Ramasubramanian
2019-10-23 13:23 ` Mimi Zohar
2019-10-23 13:23 ` Mimi Zohar
2019-10-23 17:34 ` Lakshmi Ramasubramanian
2019-10-23 17:34 ` Lakshmi Ramasubramanian
2019-10-23 17:52 ` Mimi Zohar
2019-10-23 17:52 ` Mimi Zohar
2019-10-23 18:49 ` Mimi Zohar
2019-10-23 18:49 ` Mimi Zohar
2019-10-23 0:18 ` [PATCH v1 6/6] KEYS: measure keys when they are created or updated Lakshmi Ramasubramanian
2019-10-23 0:18 ` Lakshmi Ramasubramanian
2019-10-23 18:09 ` Mimi Zohar
2019-10-23 18:09 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1571850201.5104.149.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=casey@schaufler-ca.com \
--cc=dhowells@redhat.com \
--cc=jamorris@linux.microsoft.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=nramas@linux.microsoft.com \
--cc=sashal@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.