> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -79,6 +79,7 @@ struct ima_rule_entry {
> int type; /* audit type */
> } lsm[MAX_LSM_RULES];
> char *fsname;
> + char *keyrings; /* Measure keys added to these keyrings */
> struct ima_template_desc *template;
> };
>
> @@ -356,6 +357,55 @@ int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
> return NOTIFY_OK;
> }
>
> +/**
> + * ima_match_keyring - determine whether the keyring matches the measure rule
> + * @rule: a pointer to a rule
> + * @keyring: name of the keyring to match against the measure rule
> + *
> + * If the measure action for KEY_CHECK does not specify keyrings=
> + * option then return true (Measure all keys).
> + * Else, return true if the given keyring name is present in
> + * the keyrings= option. False, otherwise.
This is suppose to be a comment, not code or pseudo code. Please
refer to the section "Comments" in Documentation/process/coding-
style.rst.
> + */
> +static bool ima_match_keyring(struct ima_rule_entry *rule,
> + const char *keyring)
> +{
> + const char *p;
> +
> + /* If "keyrings=" is not specified all keys are measured. */
> + if (!rule->keyrings)
> + return true;
> +
> + if (!keyring)
> + return false;
> +
> + /*
> + * "keyrings=" is specified in the policy in the format below:
> + * keyrings=.builtin_trusted_keys|.ima|.evm
> + *
> + * Each keyring name in the option is separated by a '|' and
> + * the last keyring name is null terminated.
> + *
> + * The given keyring is considered matched only if
> + * the whole keyring name matched a keyring name specified
> + * in the "keyrings=" option.
> + */
> + p = strstr(rule->keyrings, keyring);
> + if (p) {
> + /*
> + * Found a substring match. Check if the character
> + * at the end of the keyring name is | (keyring name
> + * separator) or is the terminating null character.
> + * If yes, we have a whole string match.
> + */
> + p += strlen(keyring);
> + if (*p == '|' || *p == '\0')
> + return true;
> + }
> +
Using "while strsep()" would simplify this code, removing the need for
such a long comment.
Mimi
> + return false;
> +}
> +
