Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756820AbbLWMZN (ORCPT ); Wed, 23 Dec 2015 07:25:13 -0500 Received: from e28smtp05.in.ibm.com ([125.16.236.5]:60988 "EHLO e28smtp05.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756695AbbLWMZK (ORCPT ); Wed, 23 Dec 2015 07:25:10 -0500 X-IBM-Helo: d28dlp03.in.ibm.com X-IBM-MailFrom: zohar@linux.vnet.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org;linux-security-module@vger.kernel.org Message-ID: <1450873498.2774.33.camel@linux.vnet.ibm.com> Subject: Re: [PATCH] IMA: policy can be updated zero times From: Mimi Zohar To: Petko Manolov Cc: Sasha Levin , dmitry.kasatkin@gmail.com, james.l.morris@oracle.com, serge@hallyn.com, linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 23 Dec 2015 07:24:58 -0500 In-Reply-To: <20151223114721.GG5662@localhost> References: <1450792283-8702-1-git-send-email-sasha.levin@oracle.com> <1450814188.2774.9.camel@linux.vnet.ibm.com> <31A92AAB-5516-4176-A947-128CB65B6931@mip-labs.com> <5679C589.1060102@oracle.com> <20151223114721.GG5662@localhost> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 15122312-0017-0000-0000-000009232E14 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1958 Lines: 44 On Wed, 2015-12-23 at 13:47 +0200, Petko Manolov wrote: > On 15-12-22 16:50:01, Sasha Levin wrote: > > On 12/22/2015 04:40 PM, Petko Manolov wrote: > > >> Thanks, Sasha. By the time ima_update_policy() is called > > >> >ima_release_policy() has already output the policy update status > > >> >message. I guess an empty policy could be considered a valid policy. > > >> >Could you add a msg indicating that the new policy was empty? > > > > > > As far as I can say we can't get to ima_update_policy() with empty > > > ima_temp_rules because ima_write_policy() will set valid_policy to 0 in case > > > of an empty rule. I'll double check it tomorrow, but please you do that > > > too. > > > > This is based on an actual crash rather than code analysis. > > I was able to reproduce the crash with: echo "" > /sys/kernel/security/ima/policy > > It turns out ima_parse_add_rule() returns 1, even though the string is empty > This logic may be part of "empty policy is a valid policy" or something else. > As it is more dangerous to change the behavior at this point i assume your patch > is the right solution for the problem. > > Acked-by: Petko Manolov > > Mimi, shall we change ima_parse_add_rule's behavior in the future or it's too > much work? ima_parse_add_rules() has no way of knowing if the policy as a whole is valid. I would define a new function in ima_policy.c to return the number of rules being added and call it at the beginning of ima_release_policy() before the status message. That way the number of rules added can be included in the status message. For now, the function could just return have rules or no rules, instead of the number of rules. Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/