linux-kernel - Re: [PATCH 8/9] ABI: security: fix location for evm and ima

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Sep 2021 16:11:49 +0200
From:   Mauro Carvalho Chehab <mchehab+huawei@...nel.org>
To:     Mimi Zohar <zohar@...ux.ibm.com>
Cc:     Linux Doc Mailing List <linux-doc@...r.kernel.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        Jonathan Corbet <corbet@....net>,
        Fabrice Gasnier <fabrice.gasnier@...com>,
        Jonathan Cameron <Jonathan.Cameron@...wei.com>,
        Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>,
        Raphael Gianotti <raphgi@...ux.microsoft.com>,
        Roberto Sassu <roberto.sassu@...wei.com>,
        THOBY Simon <Simon.THOBY@...eris.fr>,
        Tushar Sugandhi <tusharsu@...ux.microsoft.com>,
        Tyler Hicks <tyhicks@...ux.microsoft.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 8/9] ABI: security: fix location for evm and ima_policy

Em Thu, 09 Sep 2021 09:48:11 -0400
Mimi Zohar <zohar@...ux.ibm.com> escreveu:

> Hi Mauro,
> 
> On Wed, 2021-09-08 at 16:58 +0200, Mauro Carvalho Chehab wrote:
> > The What: definitions there are wrong, pointing to different
> > locations than what's expected.
> > 
> > Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@...nel.org>  
> 
> What is the purpose for the asterisks in the file path?

That's a standard filesystem wildcard. On ABI documents, there are
some other ways to specify it. The most used ones are:

	/sys/kernel/security/*/evm
	/sys/kernel/security/.../evm
	/sys/kernel/security/<something>/evm

(currently, there's no preferences between them)

If you check patches 1-3, the goal here is to have something
that will be replaced by this regex by scripts/get_abi.pl,
e.g. it will turn into:

	/sys/kernel/security/.*/evm

So, this what:

	What:		/sys/kernel/security/evm /sys/kernel/security/*/evm

Matches all three occurrences of evm on my system:

	/sys/kernel/security/evm
	/sys/kernel/security/integrity/evm
	/sys/kernel/security/integrity/evm/evm

Regards,
Mauro


> 
> thanks,
> 
> Mimi
> 
> > ---
> >  Documentation/ABI/testing/evm        | 4 ++--
> >  Documentation/ABI/testing/ima_policy | 2 +-
> >  2 files changed, 3 insertions(+), 3 deletions(-)
> > 
> > diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
> > index 553fd8a33e56..4b76a19b7bb4 100644
> > --- a/Documentation/ABI/testing/evm
> > +++ b/Documentation/ABI/testing/evm
> > @@ -1,4 +1,4 @@
> > -What:		security/evm
> > +What:		/sys/kernel/security/evm /sys/kernel/security/*/evm
> >  Date:		March 2011
> >  Contact:	Mimi Zohar <zohar@...ibm.com>
> >  Description:
> > @@ -93,7 +93,7 @@ Description:
> >  		core/ima-setup) have support for loading keys at boot
> >  		time.
> >  
> > -What:		security/integrity/evm/evm_xattrs
> > +What:		/sys/kernel/security/*/evm/evm_xattrs
> >  Date:		April 2018
> >  Contact:	Matthew Garrett <mjg59@...gle.com>
> >  Description:
> > diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
> > index 5c2798534950..2d84063d196f 100644
> > --- a/Documentation/ABI/testing/ima_policy
> > +++ b/Documentation/ABI/testing/ima_policy
> > @@ -1,4 +1,4 @@
> > -What:		security/ima/policy
> > +What:		/sys/kernel/security/*/ima/policy
> >  Date:		May 2008
> >  Contact:	Mimi Zohar <zohar@...ibm.com>
> >  Description:  
> 
>