Re: [Linux-ima-devel] [PATCH] ima: fix ineffective default hash algorithm due to invalid hash algorithm boot argument

Re: [Linux-ima-devel] [PATCH] ima: fix ineffective default hash algorithm due to invalid hash algorithm boot argument

[Mimi Zohar]

Hi Boshi,

On Wed, 2017-10-11 at 15:46 +0800, Boshi Wang wrote:
> The hash_setup function always sets hash_setup_done variable. If an
> invalid hash algorithm is passed, the default hash algorithm specified
> by CONFIG_IMA_DEFAULT_HASH could not be used.
> 
> Signed-off-by: Wang Boshi <wangboshi@huawei.com>

This patch does not apply properly.  To see the problem, save the
patch as an mbox file and then apply it using git am <filename.mbox>.

Mimi

> ---
> 
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 2aebb79..ab70a39 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -51,6 +51,8 @@ static int __init hash_setup(char *str)
>               ima_hash_algo = HASH_ALGO_SHA1;
>           else if (strncmp(str, "md5", 3) == 0)
>               ima_hash_algo = HASH_ALGO_MD5;
> +        else
> +            return 1;
>           goto out;
>       }
> 
> @@ -60,6 +62,8 @@ static int __init hash_setup(char *str)
>               break;
>           }
>       }
> +    if (i == HASH_ALGO__LAST)
> +        return 1;
>   out:
>       hash_setup_done = 1;
>       return 1;
> 
> 
> 

Re: [Linux-ima-devel] [PATCH] ima: fix ineffective default hash algorithm due to invalid hash algorithm boot argument

[Boshi Wang]

On 2017/10/18 5:58, Mimi Zohar wrote:
> This patch does not apply properly.  To see the problem, save the
> patch as an mbox file and then apply it using git am <filename.mbox>.
I'm sorry. That's my fault. The corrected patch has committed. And thank you.

[PATCH] ima: fix hash algorithm initialization

[Boshi Wang]

The hash_setup function always sets the hash_setup_done flag, even
when the hash algorithm is invalid.  This prevents the default hash
algorithm defined as CONFIG_IMA_DEFAULT_HASH from being used.

This patch sets hash_setup_done flag only for valid hash algorithms.

Signed-off-by: Boshi Wang <wangboshi@huawei.com>
---
 security/integrity/ima/ima_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 2aebb79..ab70a39 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -51,6 +51,8 @@ static int __init hash_setup(char *str)
 			ima_hash_algo = HASH_ALGO_SHA1;
 		else if (strncmp(str, "md5", 3) == 0)
 			ima_hash_algo = HASH_ALGO_MD5;
+		else
+			return 1;
 		goto out;
 	}
 
@@ -60,6 +62,8 @@ static int __init hash_setup(char *str)
 			break;
 		}
 	}
+	if (i == HASH_ALGO__LAST)
+		return 1;
 out:
 	hash_setup_done = 1;
 	return 1;
-- 
2.10.1