2021-09-08 15:01:41

by Mauro Carvalho Chehab

Subject: [PATCH 8/9] ABI: security: fix location for evm and ima_policy

The What: definitions there are wrong, pointing to different
locations than what's expected.

Signed-off-by: Mauro Carvalho Chehab <[email protected]>
---
Documentation/ABI/testing/evm | 4 ++--
Documentation/ABI/testing/ima_policy | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
index 553fd8a33e56..4b76a19b7bb4 100644
--- a/Documentation/ABI/testing/evm
+++ b/Documentation/ABI/testing/evm
@@ -1,4 +1,4 @@
-What: security/evm
+What: /sys/kernel/security/evm /sys/kernel/security/*/evm
Date: March 2011
Contact: Mimi Zohar <[email protected]>
Description:
@@ -93,7 +93,7 @@ Description:
core/ima-setup) have support for loading keys at boot
time.

-What: security/integrity/evm/evm_xattrs
+What: /sys/kernel/security/*/evm/evm_xattrs
Date: April 2018
Contact: Matthew Garrett <[email protected]>
Description:
diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index 5c2798534950..2d84063d196f 100644
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -1,4 +1,4 @@
-What: security/ima/policy
+What: /sys/kernel/security/*/ima/policy
Date: May 2008
Contact: Mimi Zohar <[email protected]>
Description:
--
2.31.1

2021-09-09 13:51:33

by Mimi Zohar

Subject: Re: [PATCH 8/9] ABI: security: fix location for evm and ima_policy

Hi Mauro,

On Wed, 2021-09-08 at 16:58 +0200, Mauro Carvalho Chehab wrote:
> The What: definitions there are wrong, pointing to different
> locations than what's expected.
>
> Signed-off-by: Mauro Carvalho Chehab <[email protected]>

What is the purpose for the asterisks in the file path?

thanks,

Mimi

> ---
> Documentation/ABI/testing/evm | 4 ++--
> Documentation/ABI/testing/ima_policy | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
> index 553fd8a33e56..4b76a19b7bb4 100644
> --- a/Documentation/ABI/testing/evm
> +++ b/Documentation/ABI/testing/evm
> @@ -1,4 +1,4 @@
> -What: security/evm
> +What: /sys/kernel/security/evm /sys/kernel/security/*/evm
> Date: March 2011
> Contact: Mimi Zohar <[email protected]>
> Description:
> @@ -93,7 +93,7 @@ Description:
> core/ima-setup) have support for loading keys at boot
> time.
>
> -What: security/integrity/evm/evm_xattrs
> +What: /sys/kernel/security/*/evm/evm_xattrs
> Date: April 2018
> Contact: Matthew Garrett <[email protected]>
> Description:
> diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
> index 5c2798534950..2d84063d196f 100644
> --- a/Documentation/ABI/testing/ima_policy
> +++ b/Documentation/ABI/testing/ima_policy
> @@ -1,4 +1,4 @@
> -What: security/ima/policy
> +What: /sys/kernel/security/*/ima/policy
> Date: May 2008
> Contact: Mimi Zohar <[email protected]>
> Description:

2021-09-09 14:17:42

by Mauro Carvalho Chehab

Subject: Re: [PATCH 8/9] ABI: security: fix location for evm and ima_policy

Em Thu, 09 Sep 2021 09:48:11 -0400
Mimi Zohar <[email protected]> escreveu:

> Hi Mauro,
>
> On Wed, 2021-09-08 at 16:58 +0200, Mauro Carvalho Chehab wrote:
> > The What: definitions there are wrong, pointing to different
> > locations than what's expected.
> >
> > Signed-off-by: Mauro Carvalho Chehab <[email protected]>
>
> What is the purpose for the asterisks in the file path?

That's a standard filesystem wildcard. On ABI documents, there are
some other ways to specify it. The most used ones are:

/sys/kernel/security/*/evm
/sys/kernel/security/.../evm
/sys/kernel/security/<something>/evm

(currently, there's no preferences between them)

If you check patches 1-3, the goal here is to have something
that will be replaced by this regex by scripts/get_abi.pl,
e.g. it will turn into:

/sys/kernel/security/.*/evm

So, this what:

What: /sys/kernel/security/evm /sys/kernel/security/*/evm

Matches all three occurrences of evm on my system:

/sys/kernel/security/evm
/sys/kernel/security/integrity/evm
/sys/kernel/security/integrity/evm/evm

Regards,
Mauro


>
> thanks,
>
> Mimi
>
> > ---
> > Documentation/ABI/testing/evm | 4 ++--
> > Documentation/ABI/testing/ima_policy | 2 +-
> > 2 files changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
> > index 553fd8a33e56..4b76a19b7bb4 100644
> > --- a/Documentation/ABI/testing/evm
> > +++ b/Documentation/ABI/testing/evm
> > @@ -1,4 +1,4 @@
> > -What: security/evm
> > +What: /sys/kernel/security/evm /sys/kernel/security/*/evm
> > Date: March 2011
> > Contact: Mimi Zohar <[email protected]>
> > Description:
> > @@ -93,7 +93,7 @@ Description:
> > core/ima-setup) have support for loading keys at boot
> > time.
> >
> > -What: security/integrity/evm/evm_xattrs
> > +What: /sys/kernel/security/*/evm/evm_xattrs
> > Date: April 2018
> > Contact: Matthew Garrett <[email protected]>
> > Description:
> > diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
> > index 5c2798534950..2d84063d196f 100644
> > --- a/Documentation/ABI/testing/ima_policy
> > +++ b/Documentation/ABI/testing/ima_policy
> > @@ -1,4 +1,4 @@
> > -What: security/ima/policy
> > +What: /sys/kernel/security/*/ima/policy
> > Date: May 2008
> > Contact: Mimi Zohar <[email protected]>
> > Description:
>
>