linux-kernel - Re: [PATCH v2 3/4] ima: limit secure boot feedback scope for appraise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200905011721.GA3225@heredoc.io>
Date:   Fri, 4 Sep 2020 22:17:21 -0300
From:   Bruno Meneguele <bmeneg@...hat.com>
To:     Mimi Zohar <zohar@...ux.ibm.com>
Cc:     linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/4] ima: limit secure boot feedback scope for appraise

On Fri, Sep 04, 2020 at 05:07:08PM -0400, Mimi Zohar wrote:
> Hi Bruno,
> 
> > +	bool sb_state = arch_ima_get_secureboot();
> > +	int appraisal_state = ima_appraise;
> >  
> >  	if (strncmp(str, "off", 3) == 0)
> > -		ima_appraise = 0;
> > +		appraisal_state = 0;
> >  	else if (strncmp(str, "log", 3) == 0)
> > -		ima_appraise = IMA_APPRAISE_LOG;
> > +		appraisal_state = IMA_APPRAISE_LOG;
> >  	else if (strncmp(str, "fix", 3) == 0)
> > -		ima_appraise = IMA_APPRAISE_FIX;
> > +		appraisal_state = IMA_APPRAISE_FIX;
> >  	else if (strncmp(str, "enforce", 7) == 0)
> > -		ima_appraise = IMA_APPRAISE_ENFORCE;
> > +		appraisal_state = IMA_APPRAISE_ENFORCE;
> >  	else
> >  		pr_err("invalid \"%s\" appraise option", str);
> > +
> > +	/* If appraisal state was changed, but secure boot is enabled,
> > +	 * keep its default */
> > +	if (sb_state) {
> > +		if (!(appraisal_state & IMA_APPRAISE_ENFORCE))
> > +			pr_info("Secure boot enabled: ignoring ima_appraise=%s option",
> > +				str);
> > +		else
> > +			ima_appraise = appraisal_state;
> > +	}
> 
> Shouldn't the "else" clause be here.   No need to re-post the entire
> patch set.

Yes, of course it should.
Sorry. Sending the v3 for this patch.

> 
> thanks,
> 
> Mimi
> 
> >  #endif
> >  	return 1;
> >  }
> 
> 

-- 
bmeneg 
PGP Key: http://bmeneg.com/pubkey.txt

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)