On Mon, Jun 3, 2019 at 6:52 PM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > On Mon, 2019-06-03 at 13:13 -0700, Matthew Garrett wrote: > > + template:= name or format of a defined IMA template > > + type (eg,ima-ng or d-ng|n-ng). Only valid when action > > + is "measure". > > This patch only supports specifying the template name, not the > template format description. Please remove "d-ng|n-ng". It supports specifying the template format, as long as the template format is already defined. I can remove the example, but it'll still work. > > struct ima_rule_entry *entry; > > int action = 0, actmask = flags | (flags << 1); > > @@ -438,6 +441,11 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, > > if ((pcr) && (entry->flags & IMA_PCR)) > > *pcr = entry->pcr; > > > > + if (template_desc && entry->template) > > + *template_desc = entry->template; > > + else > > + *template_desc = ima_template_desc_current(); > > + > > This code is finding the template format, but is subsequently being > replaced with the current description. One way of fixing this, is by > initializing the template_desc before walking the list. Ok.
