Re: [PATCH v10 5/6] IMA: Add support to limit measuring keys

[Lakshmi Ramasubramanian <nramas@xxxxxxxxxxxxxxxxxxx>]

On 12/10/19 2:43 PM, Mimi Zohar wrote:

> > +static bool ima_match_keyring(struct ima_rule_entry *rule,
> > +			      const char *keyring, const struct cred *cred)
> > +{
> > +	char *keyrings, *next_keyring, *keyrings_ptr;
> > +	bool matched = false;
> > +
> > +	/* If "keyrings=" is not specified all keys are measured. */
>
> With the addiitonal "uid" support this isn't necessarily true any
> more.
>
> Mimi

Will move the check for uid ahead of the check for keyrings.

if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
	return false;

> > +	if (!rule->keyrings)
> > +		return true;
> > +
> > +	if (!keyring)
> > +		return false;
> > +
> > +	if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
> > +		return false;
> > +

thanks,
 -lakshmi