On Tue, 2019-06-04 at 13:03 -0700, Matthew Garrett wrote: > On Mon, Jun 3, 2019 at 6:52 PM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > > On Mon, 2019-06-03 at 13:13 -0700, Matthew Garrett wrote: > > > + template:= name or format of a defined IMA template > > > + type (eg,ima-ng or d-ng|n-ng). Only valid when action > > > + is "measure". > > > > This patch only supports specifying the template name, not the > > template format description. Please remove "d-ng|n-ng". > > It supports specifying the template format, as long as the template > format is already defined. I can remove the example, but it'll still > work. Correct, as mentioned in subsequent posts. Until full support for template field descriptions is added, please remove the field format example. > > > > struct ima_rule_entry *entry; > > > int action = 0, actmask = flags | (flags << 1); > > > @@ -438,6 +441,11 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, > > > if ((pcr) && (entry->flags & IMA_PCR)) > > > *pcr = entry->pcr; > > > > > > + if (template_desc && entry->template) > > > + *template_desc = entry->template; > > > + else > > > + *template_desc = ima_template_desc_current(); > > > + > > > > This code is finding the template format, but is subsequently being > > replaced with the current description. One way of fixing this, is by > > initializing the template_desc before walking the list. > > Ok Subsequent posts pointed out that either all callers to ima_match_policy() need to pass a pointer to template_desc or *template_desc needs to be tested. thanks! Mimi
