Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755393AbbLWLrB (ORCPT ); Wed, 23 Dec 2015 06:47:01 -0500 Received: from lan.nucleusys.com ([92.247.61.126]:46474 "EHLO zztop.nucleusys.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754599AbbLWLq6 (ORCPT ); Wed, 23 Dec 2015 06:46:58 -0500 Date: Wed, 23 Dec 2015 13:47:21 +0200 From: Petko Manolov To: Sasha Levin Cc: Mimi Zohar , dmitry.kasatkin@gmail.com, james.l.morris@oracle.com, serge@hallyn.com, linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] IMA: policy can be updated zero times Message-ID: <20151223114721.GG5662@localhost> Mail-Followup-To: Sasha Levin , Mimi Zohar , dmitry.kasatkin@gmail.com, james.l.morris@oracle.com, serge@hallyn.com, linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org References: <1450792283-8702-1-git-send-email-sasha.levin@oracle.com> <1450814188.2774.9.camel@linux.vnet.ibm.com> <31A92AAB-5516-4176-A947-128CB65B6931@mip-labs.com> <5679C589.1060102@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5679C589.1060102@oracle.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Spam-Score: -1.0 (-) X-Spam-Report: Spam detection software, running on the system "zztop.nucleusys.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: On 15-12-22 16:50:01, Sasha Levin wrote: > On 12/22/2015 04:40 PM, Petko Manolov wrote: > >> Thanks, Sasha. By the time ima_update_policy() is called > >> >ima_release_policy() has already output the policy update status > >> >message. I guess an empty policy could be considered a valid policy. > >> >Could you add a msg indicating that the new policy was empty? > > > > As far as I can say we can't get to ima_update_policy() with empty > > ima_temp_rules because ima_write_policy() will set valid_policy to 0 in case > > of an empty rule. I'll double check it tomorrow, but please you do that > > too. > > This is based on an actual crash rather than code analysis. [...] Content analysis details: (-1.0 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1439 Lines: 34 On 15-12-22 16:50:01, Sasha Levin wrote: > On 12/22/2015 04:40 PM, Petko Manolov wrote: > >> Thanks, Sasha. By the time ima_update_policy() is called > >> >ima_release_policy() has already output the policy update status > >> >message. I guess an empty policy could be considered a valid policy. > >> >Could you add a msg indicating that the new policy was empty? > > > > As far as I can say we can't get to ima_update_policy() with empty > > ima_temp_rules because ima_write_policy() will set valid_policy to 0 in case > > of an empty rule. I'll double check it tomorrow, but please you do that > > too. > > This is based on an actual crash rather than code analysis. I was able to reproduce the crash with: echo "" > /sys/kernel/security/ima/policy It turns out ima_parse_add_rule() returns 1, even though the string is empty This logic may be part of "empty policy is a valid policy" or something else. As it is more dangerous to change the behavior at this point i assume your patch is the right solution for the problem. Acked-by: Petko Manolov Mimi, shall we change ima_parse_add_rule's behavior in the future or it's too much work? cheers, Petko -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/