* Re: [Linux-ima-devel] [PATCH] ima: fix ineffective default hash algorithm due to invalid hash algorithm boot argument
[not found] <3aaaf65f-d3b0-f770-f074-11e8f9796685@huawei.com>
@ 2017-10-17 21:58 ` Mimi Zohar
2017-10-18 3:36 ` Boshi Wang
2017-10-20 8:01 ` [PATCH] ima: fix hash algorithm initialization Boshi Wang
1 sibling, 1 reply; 3+ messages in thread
From: Mimi Zohar @ 2017-10-17 21:58 UTC (permalink / raw)
To: Boshi Wang; +Cc: linux-integrity
Hi Boshi,
On Wed, 2017-10-11 at 15:46 +0800, Boshi Wang wrote:
> The hash_setup function always sets hash_setup_done variable. If an
> invalid hash algorithm is passed, the default hash algorithm specified
> by CONFIG_IMA_DEFAULT_HASH could not be used.
>
> Signed-off-by: Wang Boshi <wangboshi@huawei.com>
This patch does not apply properly. To see the problem, save the
patch as an mbox file and then apply it using git am <filename.mbox>.
Mimi
> ---
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 2aebb79..ab70a39 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -51,6 +51,8 @@ static int __init hash_setup(char *str)
> ima_hash_algo = HASH_ALGO_SHA1;
> else if (strncmp(str, "md5", 3) == 0)
> ima_hash_algo = HASH_ALGO_MD5;
> + else
> + return 1;
> goto out;
> }
>
> @@ -60,6 +62,8 @@ static int __init hash_setup(char *str)
> break;
> }
> }
> + if (i == HASH_ALGO__LAST)
> + return 1;
> out:
> hash_setup_done = 1;
> return 1;
>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH] ima: fix hash algorithm initialization
[not found] <3aaaf65f-d3b0-f770-f074-11e8f9796685@huawei.com>
2017-10-17 21:58 ` [Linux-ima-devel] [PATCH] ima: fix ineffective default hash algorithm due to invalid hash algorithm boot argument Mimi Zohar
@ 2017-10-20 8:01 ` Boshi Wang
1 sibling, 0 replies; 3+ messages in thread
From: Boshi Wang @ 2017-10-20 8:01 UTC (permalink / raw)
To: zohar, dmitry.kasatkin, james.l.morris, serge
Cc: linux-ima-devel, linux-ima-user, linux-integrity,
linux-security-module
The hash_setup function always sets the hash_setup_done flag, even
when the hash algorithm is invalid. This prevents the default hash
algorithm defined as CONFIG_IMA_DEFAULT_HASH from being used.
This patch sets hash_setup_done flag only for valid hash algorithms.
Signed-off-by: Boshi Wang <wangboshi@huawei.com>
---
security/integrity/ima/ima_main.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 2aebb79..ab70a39 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -51,6 +51,8 @@ static int __init hash_setup(char *str)
ima_hash_algo = HASH_ALGO_SHA1;
else if (strncmp(str, "md5", 3) == 0)
ima_hash_algo = HASH_ALGO_MD5;
+ else
+ return 1;
goto out;
}
@@ -60,6 +62,8 @@ static int __init hash_setup(char *str)
break;
}
}
+ if (i == HASH_ALGO__LAST)
+ return 1;
out:
hash_setup_done = 1;
return 1;
--
2.10.1
^ permalink raw reply related [flat|nested] 3+ messages in thread