On Sat, Jul 08, 2023 at 12:23:02AM -0400, Paul Moore wrote:
> On Jun 28, 2023 Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx> wrote:
> >
> > IPE is designed to provide system level trust guarantees, this usually
> > implies that trust starts from bootup with a hardware root of trust,
> > which validates the bootloader. After this, the bootloader verifies the
> > kernel and the initramfs.
> >
> > As there's no currently supported integrity method for initramfs, and
> > it's typically already verified by the bootloader, introduce a property
> > that causes the first superblock to have an execution to be "pinned",
> > which is typically initramfs.
> >
> > When the "pinned" device is unmounted, it will be "unpinned" and
> > `boot_verified` property will always evaluate to false afterward.
> >
> > We use a pointer with a spin_lock to "pin" the device instead of rcu
> > because rcu synchronization may sleep, which is not allowed when
> > unmounting a device.
> >
> > Signed-off-by: Deven Bowers <deven.desai@xxxxxxxxxxxxxxxxxxx>
> > Signed-off-by: Fan Wu <wufan@xxxxxxxxxxxxxxxxxxx>
> > ---
> > security/ipe/eval.c | 72 +++++++++++++++++++++++++++++++++++-
> > security/ipe/eval.h | 2 +
> > security/ipe/hooks.c | 12 ++++++
> > security/ipe/hooks.h | 2 +
> > security/ipe/ipe.c | 1 +
> > security/ipe/policy.h | 2 +
> > security/ipe/policy_parser.c | 37 +++++++++++++++++-
> > 7 files changed, 126 insertions(+), 2 deletions(-)
>
> The compilation errors continue into this patch.
>
Sorry again for the header file problem.
> > diff --git a/security/ipe/policy_parser.c b/security/ipe/policy_parser.c
> > index 27e5767480b0..28c14adfe6d2 100644
> > --- a/security/ipe/policy_parser.c
> > +++ b/security/ipe/policy_parser.c
> > @@ -265,6 +265,12 @@ static enum ipe_action_type parse_action(char *t)
> > return match_token(t, action_tokens, args);
> > }
> >
> > +static const match_table_t property_tokens = {
> > + {__IPE_PROP_BOOT_VERIFIED_FALSE, "boot_verified=FALSE"},
> > + {__IPE_PROP_BOOT_VERIFIED_TRUE, "boot_verified=TRUE"},
> > + {__IPE_PROP_INVALID, NULL}
> > +};
> > +
> > /**
> > * parse_property - Parse the property type given a token string.
> > * @t: Supplies the token string to be parsed.
> > @@ -277,7 +283,36 @@ static enum ipe_action_type parse_action(char *t)
> > */
> > static int parse_property(char *t, struct ipe_rule *r)
> > {
> > - return -EBADMSG;
> > + substring_t args[MAX_OPT_ARGS];
> > + struct ipe_prop *p = NULL;
> > + int rc = 0;
> > + int token;
> > +
> > + p = kzalloc(sizeof(*p), GFP_KERNEL);
> > + if (!p)
> > + return -ENOMEM;
> > +
> > + token = match_token(t, property_tokens, args);
> > +
> > + switch (token) {
> > + case __IPE_PROP_BOOT_VERIFIED_FALSE:
> > + case __IPE_PROP_BOOT_VERIFIED_TRUE:
> > + p->type = token;
> > + break;
> > + case __IPE_PROP_INVALID:
>
> You generally don't need to explicitly specify a case if the code
> immediately falls through to 'default'.
>
Got it, I will remove this line.
> > + default:
> > + rc = -EBADMSG;
> > + break;
> > + }
> > + if (rc)
> > + goto err;
> > + list_add_tail(&p->next, &r->props);
> > +
> > +out:
> > + return rc;
> > +err:
> > + kfree(p);
> > + goto out;
>
> Once again, don't use a goto when the jump destination simply does a
> return, do the return directly.
>
Sure, I will replace the goto with return.
-Fan
> > }
> >
> > /**
> > --
> > 2.25.1
>
> --
> paul-moore.com
