Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762468AbYLCUff (ORCPT ); Wed, 3 Dec 2008 15:35:35 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1758491AbYLCULi (ORCPT ); Wed, 3 Dec 2008 15:11:38 -0500 Received: from hrndva-omtalb.mail.rr.com ([71.74.56.122]:60580 "EHLO hrndva-omtalb.mail.rr.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757707AbYLCULf (ORCPT ); Wed, 3 Dec 2008 15:11:35 -0500 Date: Wed, 3 Dec 2008 14:13:20 -0600 From: "Serge E. Hallyn" To: Christoph Hellwig Cc: Mimi Zohar , linux-kernel@vger.kernel.org, Andrew Morton , James Morris , Al Viro , David Safford , Serge Hallyn , Mimi Zohar Subject: Re: [PATCH 2/6] integrity: Linux Integrity Module(LIM) Message-ID: <20081203201320.GA17785@hallyn.com> Reply-To: "In-Reply-To:20081203123021.GA30035"@infradead.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.15+20070412 (2007-04-11) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2208 Lines: 62 Quoting Christoph Hellwig (hch@infradead.org): > On Tue, Dec 02, 2008 at 04:47:56PM -0500, Mimi Zohar wrote: > > +/* > > + * Integrity API calls: > > + * > > + * @collect_measurement: > > + * Collect template specific measurement data. > > + * @data contains template specific data used for collecting the > > + * measurement. > > + * Return 0 if operation was successful. > > + * > > + * @appraise_measurement: > > + * Appraise the integrity of the template specific measurement data. > > + * @data contains template specific data used for appraising the > > + * measurement. > > + * Return 0 if operation was successful. > > + * > > + * @store_measurement: > > + * Store the template specific data. > > + * @data contains template specific data used for storing the > > + * measurement. > > + * > > + * @store_template: > > + * Store the entry containing the template specific data. > > + * @data contains template name, data length, and data. > > + * > > + * @must_measure: > > + * Measurement decision based on an integrity policy. > > + * @data contains template specific data used for making policy > > + * decision. > > + * Return 0 if operation was successful. This comment isn't right - return 0 if a measurement must be taken, no? > > + * > > + * @display_template: > > + * Display template specific data. > > + * > > + */ > > Can you explain what all this template stuff is about? The only method > of these ever called is display_template, I'm not sure what you mean here - must_measure for instance is used (in patch 3) in the integrity hooks (i.e. file_mmap) to decide whether or not the object (action target) must be measured. > and that seems to be better > implented directly as a securityfs file, without the indirection. That comment doesn't make sense to me (unless you're saying to punt on the generic integrity infrastructure and hook all of the IMA code straight into the kernel) so I suspect I'm misreading something. -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/