[PATCH v3 12/19] firmware_loader: Use security_post_load_data()

2020-07-24 Thread Kees Cook
Now that security_post_load_data() is wired up, use it instead of the NULL file argument style of security_post_read_file(), and update the security_kernel_load_data() call to indicate that a security_kernel_post_load_data() call is expected. Wire up the IMA check to match earlier logic. Perhaps a

Re: [PATCH v3 12/19] firmware_loader: Use security_post_load_data()

2020-07-28 Thread Kees Cook
On Mon, Jul 27, 2020 at 06:57:45AM -0400, Mimi Zohar wrote: > On Fri, 2020-07-24 at 14:36 -0700, Kees Cook wrote: > > Now that security_post_load_data() is wired up, use it instead > > of the NULL file argument style of security_post_read_file(), > > and update the security_kernel_load_data() call

Re: [PATCH v3 12/19] firmware_loader: Use security_post_load_data()

2020-07-29 Thread Mimi Zohar
On Tue, 2020-07-28 at 12:43 -0700, Kees Cook wrote: > On Mon, Jul 27, 2020 at 06:57:45AM -0400, Mimi Zohar wrote: > > On Fri, 2020-07-24 at 14:36 -0700, Kees Cook wrote: > > > Now that security_post_load_data() is wired up, use it instead > > > of the NULL file argument style of security_post_read_

Re: [PATCH v3 12/19] firmware_loader: Use security_post_load_data()

2020-07-29 Thread Mimi Zohar
On Wed, 2020-07-29 at 12:29 -0400, Mimi Zohar wrote: > On Tue, 2020-07-28 at 12:43 -0700, Kees Cook wrote: > > On Mon, Jul 27, 2020 at 06:57:45AM -0400, Mimi Zohar wrote: > > > On Fri, 2020-07-24 at 14:36 -0700, Kees Cook wrote: > > > > Now that security_post_load_data() is wired up, use it instead

Re: [PATCH v3 12/19] firmware_loader: Use security_post_load_data()

2020-07-29 Thread Kees Cook
On Wed, Jul 29, 2020 at 02:10:18PM -0400, Mimi Zohar wrote: > Actually, the partial firmware read should be calling > security_kernel_read_file(). Yup, it does[1], and when "whole_file" is true, it will call security_kernel_post_read_file() with the buffer contents at the end. > The sysfs firmwar

Re: [PATCH v3 12/19] firmware_loader: Use security_post_load_data()

2020-07-27 Thread Mimi Zohar
On Fri, 2020-07-24 at 14:36 -0700, Kees Cook wrote: > Now that security_post_load_data() is wired up, use it instead > of the NULL file argument style of security_post_read_file(), > and update the security_kernel_load_data() call to indicate that a > security_kernel_post_load_data() call is expect