On Wed, 2018-03-14 at 21:03 -0300, Thiago Jung Bauermann wrote: > Hello Serge, > > Thanks for quickly reviewing these patches! > > Serge E. Hallyn <se...@hallyn.com> writes: > > > Quoting Thiago Jung Bauermann (bauer...@linux.vnet.ibm.com): > >> From: Mimi Zohar <zo...@linux.vnet.ibm.com> > >> @@ -241,16 +241,20 @@ int ima_appraise_measurement(enum ima_hooks func, > >> } > >> > >> status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint); > >> - if ((status != INTEGRITY_PASS) && > >> - (status != INTEGRITY_PASS_IMMUTABLE) && > >> - (status != INTEGRITY_UNKNOWN)) { > >> - if ((status == INTEGRITY_NOLABEL) > >> - || (status == INTEGRITY_NOXATTRS)) > >> - cause = "missing-HMAC"; > >> - else if (status == INTEGRITY_FAIL) > >> - cause = "invalid-HMAC"; > >> + switch (status) { > >> + case INTEGRITY_PASS: > >> + case INTEGRITY_PASS_IMMUTABLE: > >> + case INTEGRITY_UNKNOWN: > > > > Wouldn't it be more future-proof to replace this with a 'default', or > > to at least add a "default: BUG()" to catch new status values? > > I agree. I like the "default: BUG()" option.
Agreed. I would put it at the end after INTEGRITY_FAIL. > > >> + break; > >> + case INTEGRITY_NOXATTRS: /* No EVM protected xattrs. */ > >> + case INTEGRITY_NOLABEL: /* No security.evm xattr. */ > >> + cause = "missing-HMAC"; > >> + goto out; > >> + case INTEGRITY_FAIL: /* Invalid HMAC/signature. */ > >> + cause = "invalid-HMAC"; > >> goto out; > >> } > >> + > >> switch (xattr_value->type) { > >> case IMA_XATTR_DIGEST_NG: > >> /* first byte contains algorithm id */ > >> @@ -316,17 +320,20 @@ int ima_appraise_measurement(enum ima_hooks func, > >> integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, > >> op, cause, rc, 0); > >> } else if (status != INTEGRITY_PASS) { > >> + /* Fix mode, but don't replace file signatures. */ > >> if ((ima_appraise & IMA_APPRAISE_FIX) && > >> (!xattr_value || > >> xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { > >> if (!ima_fix_xattr(dentry, iint)) > >> status = INTEGRITY_PASS; > >> - } else if ((inode->i_size == 0) && > >> - (iint->flags & IMA_NEW_FILE) && > >> - (xattr_value && > >> - xattr_value->type == EVM_IMA_XATTR_DIGSIG)) { > >> + } > >> + > >> + /* Permit new files with file signatures, but without data. */ > >> + if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE && > > > > This may be correct, but it's not identical to what you're replacing. > > Since in either case you're setting status to INTEGRITY_PASS the final > > result is the same, but with a few extra possible steps. Not sure > > whether that matters. > > Good point. I'll have to defer this one to Mimi though. The end result is the same, but add some needed comments. Mimi > > > > >> + xattr_value && xattr_value->type == EVM_IMA_XATTR_DIGSIG) { > >> status = INTEGRITY_PASS; > >> } > >> + > >> integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, > >> op, cause, rc, 0); > >> } else { > >