Re: [PATCH v9 5/8] ima: make process_buffer_measurement() generic

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 10/23/19 8:47 PM, Nayna Jain wrote:

Hi Nayna,

process_buffer_measurement() is limited to measuring the kexec boot
command line. This patch makes process_buffer_measurement() more
generic, allowing it to measure other types of buffer data (e.g.
blacklisted binary hashes or key hashes).

Now that process_buffer_measurement() is being made generic to measure any buffer, it would be good to add a tag to indicate what type of buffer is being measured.

For example, if the buffer is kexec command line the log could look like:

 "kexec_cmdline: <command line data>"

Similarly, if the buffer is blacklisted binary hash:

 "blacklist hash: <data>".

If the buffer is key hash:

 "<name of the keyring>: key data".

This would greatly help the consumer of the IMA log to know the type of data represented in each IMA log entry.

thanks,
 -lakshmi



[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux