From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B822C433E6 for ; Tue, 16 Mar 2021 17:22:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E766D6508D for ; Tue, 16 Mar 2021 17:22:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238844AbhCPRVh (ORCPT ); Tue, 16 Mar 2021 13:21:37 -0400 Received: from mx2.suse.de ([195.135.220.15]:54608 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239228AbhCPRV1 (ORCPT ); Tue, 16 Mar 2021 13:21:27 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id B47D3AE78; Tue, 16 Mar 2021 17:21:25 +0000 (UTC) Date: Tue, 16 Mar 2021 18:21:24 +0100 From: Petr Vorel To: Lakshmi Ramasubramanian Cc: Mimi Zohar , tusharsu@linux.microsoft.com, ltp@lists.linux.it, linux-integrity@vger.kernel.org Subject: Re: [PATCH v2] IMA: Allow only ima-buf template for key measurement Message-ID: Reply-To: Petr Vorel References: <20210314233646.2925-1-nramas@linux.microsoft.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Hi Lakshmi, > > Just a double check does it always work without template=ima-buf for all kernel versions? > > Or only for kernels with dea87d0889dd ("ima: select ima-buf template for buffer measurement") > > i.e. v5.11-rc1 or backport? > The above change is required. Prior to this change, template has to be > specified in the policy, otherwise the default template would be used. The default template is ima-ng, right? >From what you write I understand that "measure func=KEY_CHECK keyrings=.ima|.evm" will work only on newer kernel, thus we should always use template=ima-buf as the policy example so that it's working also on that few kernels between (which have IMA key functionality, but not dea87d0889dd), right? But we should mention that in the README.md. Kind regards, Petr > > Also, don't we want to change also keycheck.policy? > > Currently it contains: > > measure func=KEY_CHECK keyrings=.ima|.evm|.builtin_trusted_keys|.blacklist|key_import_test template=ima-buf > > Do we want to drop template=ima-buf to test the default value? Or have two rules > > (one with template=ima-buf, other w/a?) > Good point. > I will send you the v3 patch - with two rules: one with template=buf and > other without a template, like the following example: > measure func=KEY_CHECK > keyrings=.builtin_trusted_keys|.blacklist|key_import_test template=ima-buf > measure func=KEY_CHECK keyrings=.ima|.evm > -lakshmi