Re: [PATCH v5 2/2] ima: measure userspace policy writes before parsing

[Mimi Zohar <zohar@linux.ibm.com>]

On Tue, 2026-07-07 at 15:25 +0000, Enrico  Bravi wrote:
> On Mon, 2026-07-06 at 23:03 -0400, Mimi Zohar wrote


> > ima_match_rule_data() should only be called for buffer measurements, when
> > there
> > is no inode. 
> > 
> > +               return ((rule->func == func) && !inode &&
> >                         ima_match_rule_data(rule, func_data, cred));
> 
> I was thinking that in this way, it would not trigger the measurement when
> loading the policy from a file. If inode is not NULL, it directly returns false
> instead of continuing. What do you thing of something like this:
> 
>         switch (func) {
> +       case POLICY_CHECK:
> +               if (inode)
> +                       break;
> +               fallthrough;
>         case KEY_CHECK:
>         case CRITICAL_DATA:
>                 return ((rule->func == func) &&
>                         ima_match_rule_data(rule, func_data, cred));

Yes, your version is clearer.

Mimi