linux-kernel - Re: [PATCH] ima: Support euid keyword for buffer measurement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2f26bc3df4851b3af93d51742de99b1c4f197e68.camel@linux.ibm.com>
Date:   Mon, 19 Jul 2021 17:30:34 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Roberto Sassu <roberto.sassu@...wei.com>,
        Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>
Cc:     "tusharsu@...ux.microsoft.com" <tusharsu@...ux.microsoft.com>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ima: Support euid keyword for buffer measurement

Hi Roberto,

On Wed, 2021-07-07 at 07:15 +0000, Roberto Sassu wrote:
> > From: Lakshmi Ramasubramanian [mailto:nramas@...ux.microsoft.com]
> > Sent: Tuesday, July 6, 2021 9:30 PM
> > On 7/5/2021 4:56 AM, Roberto Sassu wrote:
> > 
> > Hi Roberto,
> > 
> > > This patch makes the 'euid' keyword available for buffer measurement rules,
> > > in the same way as for other rules. Currently, there is only support for
> > > the 'uid' keyword.
> > >
> > > With this change, buffer measurement (or non-measurement) can depend
> > also
> > > on the process effective UID.
> > 
> > Who (kernel component) will be using this?
> 
> Hi Lakshmi
> 
> I'm using it in a (not yet submitted) test for digest lists.
> 
> It is in a dont_measure rule to try to unload a digest list
> without measurement and to check that this is not allowed
> if the digest list was measured at addition time (to ensure
> completeness of information).
> 
> > Maybe you could make this change as part of the patch set in which the
> > above "euid" support will be used.
> 
> I wanted to send the digest lists patch set without anything
> else. I could resend the patch as part of that patch set if it is
> preferred.

Unless there is another usecase, please keep it with the digest list
tests patch set.

Reviewed-by: Mimi Zohar <zohar@...ux.ibm.com>

thanks,

Mimi