lkml.org 
[lkml]   [2019]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v10 5/6] IMA: Add support to limit measuring keys
From
Date
On 12/10/19 2:43 PM, Mimi Zohar wrote:

>> +static bool ima_match_keyring(struct ima_rule_entry *rule,
>> + const char *keyring, const struct cred *cred)
>> +{
>> + char *keyrings, *next_keyring, *keyrings_ptr;
>> + bool matched = false;
>> +
>> + /* If "keyrings=" is not specified all keys are measured. */
>
> With the addiitonal "uid" support this isn't necessarily true any
> more.
>
> Mimi

Will move the check for uid ahead of the check for keyrings.

if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
return false;

>
>> + if (!rule->keyrings)
>> + return true;
>> +
>> + if (!keyring)
>> + return false;
>> +
>> + if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
>> + return false;
>> +

thanks,
-lakshmi


\
 
 \ /
  Last update: 2019-12-11 00:24    [W:0.037 / U:12.168 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site