From: Mimi Zohar <zohar@linux.ibm.com>
To: Eric Biggers <ebiggers@kernel.org>
Cc: linux-integrity@vger.kernel.org,
Stefan Berger <stefanb@linux.ibm.com>,
linux-fscrypt@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v5 5/8] ima: permit fsverity's file digests in the IMA measurement list
Date: Thu, 17 Mar 2022 11:58:24 -0400 [thread overview]
Message-ID: <692a64e10646154ee7310b62ffd74025f29cdccf.camel@linux.ibm.com> (raw)
In-Reply-To: <YhbUBJbQ+nCN515p@sol.localdomain>
> diff --git a/security/integrity/integrity.h
b/security/integrity/integrity.h
> > index daf49894fd7d..39a999877013 100644
> > --- a/security/integrity/integrity.h
> > +++ b/security/integrity/integrity.h
> > @@ -32,7 +32,7 @@
> > #define IMA_HASHED 0x00000200
> >
> > /* iint policy rule cache flags */
> > -#define IMA_NONACTION_FLAGS 0xff000000
> > +#define IMA_NONACTION_FLAGS 0xff800000
> > #define IMA_DIGSIG_REQUIRED 0x01000000
> > #define IMA_PERMIT_DIRECTIO 0x02000000
> > #define IMA_NEW_FILE 0x04000000
> > @@ -40,6 +40,8 @@
> > #define IMA_FAIL_UNVERIFIABLE_SIGS 0x10000000
> > #define IMA_MODSIG_ALLOWED 0x20000000
> > #define IMA_CHECK_BLACKLIST 0x40000000
> > +#define IMA_VERITY_REQUIRED 0x80000000
> > +#define IMA_VERITY_DIGEST 0x00800000
>
> How about defining these flags in numerical order?
Originally I increased the flags size, but I'd like to avoid as much
patch churn as possible for the namespacing patch set.
Mimi
next prev parent reply other threads:[~2022-03-17 15:58 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-11 21:43 [PATCH v5 0/8] ima: support fs-verity digests and signatures Mimi Zohar
2022-02-11 21:43 ` [PATCH v5 1/8] ima: rename IMA_ACTION_FLAGS to IMA_NONACTION_FLAGS Mimi Zohar
2022-02-14 20:03 ` Stefan Berger
2022-02-15 18:11 ` Mimi Zohar
2022-02-11 21:43 ` [PATCH v5 2/8] ima: define ima_max_digest_data struct without a flexible array variable Mimi Zohar
2022-02-14 20:13 ` Stefan Berger
2022-02-11 21:43 ` [PATCH v5 3/8] fs-verity: define a function to return the integrity protected file digest Mimi Zohar
2022-02-23 23:59 ` Eric Biggers
2022-02-24 1:21 ` Mimi Zohar
2022-02-24 1:26 ` Eric Biggers
2022-02-24 1:27 ` Mimi Zohar
2022-02-11 21:43 ` [PATCH v5 4/8] ima: define a new template field 'd-type' and a new template 'ima-ngv2' Mimi Zohar
2022-02-14 20:38 ` Stefan Berger
2022-02-24 0:32 ` Eric Biggers
2022-02-24 16:16 ` Mimi Zohar
2022-02-24 18:46 ` Eric Biggers
2022-02-25 20:01 ` Mimi Zohar
2022-02-11 21:43 ` [PATCH v5 5/8] ima: permit fsverity's file digests in the IMA measurement list Mimi Zohar
2022-02-24 0:40 ` Eric Biggers
2022-03-17 15:58 ` Mimi Zohar [this message]
2022-02-11 21:43 ` [PATCH v5 6/8] ima: define signature version 3 Mimi Zohar
2022-02-24 0:50 ` Eric Biggers
2022-02-11 21:43 ` [PATCH v5 7/8] ima: support fs-verity file digest based version 3 signatures Mimi Zohar
2022-02-24 1:24 ` Eric Biggers
2022-03-17 15:46 ` Mimi Zohar
2022-02-11 21:43 ` [PATCH v5 8/8] fsverity: update the documentation Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=692a64e10646154ee7310b62ffd74025f29cdccf.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=ebiggers@kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stefanb@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.