linux-kernel - Re: linux-next: manual merge of the pidfd tree with the integrity tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210215080717.24bc532e@canb.auug.org.au>
Date:   Mon, 15 Feb 2021 08:07:17 +1100
From:   Stephen Rothwell <sfr@...b.auug.org.au>
To:     Christian Brauner <christian@...uner.io>,
        Mimi Zohar <zohar@...ux.vnet.ibm.com>,
        Dmitry Kasatkin <dmitry.kasatkin@...il.com>
Cc:     Christian Brauner <christian.brauner@...ntu.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Next Mailing List <linux-next@...r.kernel.org>,
        Mimi Zohar <zohar@...ux.ibm.com>,
        Tushar Sugandhi <tusharsu@...ux.microsoft.com>
Subject: Re: linux-next: manual merge of the pidfd tree with the integrity
 tree

Hi all,

On Mon, 25 Jan 2021 17:18:18 +1100 Stephen Rothwell <sfr@...b.auug.org.au> wrote:
> 
> Today's linux-next merge of the pidfd tree got a conflict in:
> 
>   security/integrity/ima/ima_api.c
> 
> between commit:
> 
>   2b4a2474a202 ("IMA: generalize keyring specific measurement constructs")
> 
> from the integrity tree and commit:
> 
>   a2d2329e30e2 ("ima: handle idmapped mounts")
> 
> from the pidfd tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
> 
> diff --cc security/integrity/ima/ima_api.c
> index 1dd70dc68ffd,ed410efb3597..000000000000
> --- a/security/integrity/ima/ima_api.c
> +++ b/security/integrity/ima/ima_api.c
> @@@ -183,17 -184,18 +184,18 @@@ err_out
>    * Returns IMA_MEASURE, IMA_APPRAISE mask.
>    *
>    */
> - int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
> - 		   int mask, enum ima_hooks func, int *pcr,
> + int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
> + 		   const struct cred *cred, u32 secid, int mask,
> + 		   enum ima_hooks func, int *pcr,
>   		   struct ima_template_desc **template_desc,
>  -		   const char *keyring)
>  +		   const char *func_data)
>   {
>   	int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
>   
>   	flags &= ima_policy_flag;
>   
> - 	return ima_match_policy(inode, cred, secid, func, mask, flags, pcr,
> - 				template_desc, func_data);
> + 	return ima_match_policy(mnt_userns, inode, cred, secid, func, mask,
>  -				flags, pcr, template_desc, keyring);
> ++				flags, pcr, template_desc, func_data);
>   }
>   
>   /*

With the merge window about to open, this is a reminder that this
conflict still exists.

-- 
Cheers,
Stephen Rothwell

Content of type "application/pgp-signature" skipped