Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1629804

Re: [PATCH 3/6] ima: Simplify policy_func_show.

Show all headers | View raw

Am Freitag, 21. April 2017, 09:57:56 BRT schrieb Mimi Zohar:
> On Thu, 2017-04-20 at 17:40 -0300, Thiago Jung Bauermann wrote:
> > @@ -949,49 +936,16 @@ void ima_policy_stop(struct seq_file *m, void *v)
> > 
> >  #define pt(token)	policy_tokens[token + Opt_err].pattern
> >  #define mt(token)	mask_tokens[token]
> > 
> > -#define ft(token)	func_tokens[token]
> > 
> >  /*
> >  
> >   * policy_func_show - display the ima_hooks policy rule
> >   */
> >  
> >  static void policy_func_show(struct seq_file *m, enum ima_hooks func)
> >  {
> > 
> > -	char tbuf[64] = {0,};
> > -
> > -	switch (func) {
> > -	case FILE_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_file));
> > -		break;
> > -	case MMAP_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_mmap));
> > -		break;
> > -	case BPRM_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_bprm));
> > -		break;
> > -	case MODULE_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_module));
> > -		break;
> > -	case FIRMWARE_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_firmware));
> > -		break;
> > -	case POST_SETATTR:
> > -		seq_printf(m, pt(Opt_func), ft(func_post));
> > -		break;
> > -	case KEXEC_KERNEL_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_kexec_kernel));
> > -		break;
> > -	case KEXEC_INITRAMFS_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_kexec_initramfs));
> > -		break;
> > -	case POLICY_CHECK:
> > -		seq_printf(m, pt(Opt_func), ft(func_policy));
> > -		break;
> > -	default:
> > -		snprintf(tbuf, sizeof(tbuf), "%d", func);
> > -		seq_printf(m, pt(Opt_func), tbuf);
> > -		break;
> > -	}
> > -	seq_puts(m, " ");
> > +	if (func > 0 && func < MAX_CHECK)
> > +		seq_printf(m, "func=%s ", func_tokens[func]);
> > +	else
> > +		seq_printf(m, "func=%d ", func);
> 
> The only time this can happen is when __kernel_read_file_id() is
> updated without updating the read_idmap[].  Perhaps we can display the
> number and the appropriate __kernel_read_file_id string.

From what I understood of the code func comes from ima_parse_rule, so that 
condition would only happen if ima_parse_rule got out of sync with 
func_tokens. Since that code only initializes func with constants from enum 
ima_hooks and this patch makes ima_hooks automatically sync with func_tokens, 
the else branch is more like a "can't happen" safety net.

read_idmap is only used in ima_post_read_file, and I couldn't see a relation 
between that code path and the one for ima_policy_show.

-- 
Thiago Jung Bauermann
IBM Linux Technology Center

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/6] Appended signatures support for IMA appraisal Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-18 22:20 +0200
  [PATCH 5/6] MODSIGN: Export module signature definitions. Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-18 22:20 +0200
    Re: [PATCH 5/6] MODSIGN: Export module signature definitions. Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-04-20 14:40 +0200
      Re: [PATCH 5/6] MODSIGN: Export module signature definitions. David Howells <dhowells@redhat.com> - 2017-04-20 16:40 +0200
        Re: [PATCH 5/6] MODSIGN: Export module signature definitions. Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-20 23:10 +0200
  [PATCH 2/6] ima: Tidy up constant strings Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-18 22:20 +0200
  [PATCH 3/6] ima: Simplify policy_func_show. Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-18 22:20 +0200
    Re: [PATCH 3/6] ima: Simplify policy_func_show. Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-04-20 14:20 +0200
      Re: [PATCH 3/6] ima: Simplify policy_func_show. Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-20 22:50 +0200
        Re: [PATCH 3/6] ima: Simplify policy_func_show. Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-04-21 16:00 +0200
          Re: [PATCH 3/6] ima: Simplify policy_func_show. Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-24 19:20 +0200
  [PATCH 1/6] integrity: Small code improvements Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-18 22:20 +0200
  [PATCH 4/6] ima: Log the same audit cause whenever a file has no signature Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-18 22:30 +0200
  [PATCH 6/6] ima: Support appended signatures for appraisal Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-18 22:30 +0200
    Re: [PATCH 6/6] ima: Support appended signatures for appraisal kbuild test robot <lkp@intel.com> - 2017-04-20 05:10 +0200
      Re: [PATCH 6/6] ima: Support appended signatures for appraisal Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-21 01:50 +0200
        Re: [PATCH 6/6] ima: Support appended signatures for appraisal Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> - 2017-04-27 00:20 +0200
          Re: [PATCH 6/6] ima: Support appended signatures for appraisal Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-27 23:50 +0200
            Re: [PATCH 6/6] ima: Support appended signatures for appraisal Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> - 2017-04-28 00:20 +0200
    Re: [PATCH 6/6] ima: Support appended signatures for appraisal Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-04-26 14:30 +0200
      Re: [PATCH 6/6] ima: Support appended signatures for appraisal Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> - 2017-04-26 22:50 +0200

csiph-web