Re: [PATCH v3 ima-evm-utils 2/4] Restore correct HMAC calculation for directories

[Stefan Berger <stefanb@linux.ibm.com>]

On 6/16/23 15:23, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> Commit 6ecb88352886 ("evmctl: Remove left-over check S_ISDIR() for
> directory signing") removes fetching the inode generation for directories.
> 
> While directories might not be signed, EVM currently calculates the HMAC on
> them, including the inode generation.

> 
> To keep user space and kernel space aligned, reenable fetching the inode
> generation for directories, and add again the comment that the inode
> generation cannot be obtained for special files.

The user wouldn't notice anything, right?

> 
> Fixes: Commit 6ecb88352886 ("evmctl: Remove left-over check S_ISDIR() for directory signing")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>   src/evmctl.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/src/evmctl.c b/src/evmctl.c
> index c24261cf0e6..7a3ffd7c823 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -1229,7 +1229,11 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *s
>   		goto out;
>   	}
>   
> -	if (S_ISREG(st.st_mode)) {
> +	if (S_ISREG(st.st_mode) || S_ISDIR(st.st_mode)) {
> +		/*
> +		 * We cannot at the moment get generation of special files..
> +		 * kernel API does not support it.
> +		 */
>   		int fd = open(file, 0);
>   
>   		if (fd < 0) {

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>