On 11/6/2019 2:43 PM, Mimi Zohar wrote:
+void ima_post_key_create_or_update(struct key *keyring, struct key *key,
+ unsigned long flags, bool create)
+{
+ if ((keyring != NULL) && (key != NULL))
+ return;
I would move the patch that defines the "keyring=" policy option prior
to this one. Include the call to process_buffer_measurement() in this
patch. A subsequent patch would add support to defer measuring the
key, by calling a function named something like
ima_queue_key_measurement().
Mimi
As I'd stated in the other response, I wanted to isolate all key related
code in a separate C file and build it if and only if all CONFIG
dependencies are met.
I can do the following:
=> Define the IMA hook in ima_asymmetric_keys.c instead of ima_main.c
=> In include/linux/ima.h declare the IMA hook if
CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS is enabled.
Else, NOP it.
#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
extern void ima_post_key_create_or_update(struct key *keyring,
struct key *key,
unsigned long flags,
bool create);
#else
static inline void ima_post_key_create_or_update(struct key *keyring,
struct key *key,
unsigned long flags,
bool create) {}
#endif
Would that be acceptable?
thanks,
-lakshmi
