ima: fix error handling logic when file measurement failed
Subsystems (4)
PATCH 1/1 ima: fix error handling logic when file measurement failed
Restore the error handling logic so that when file measurement fails, the respective iint entry is not left with the digest data being populated with zeroes.
--- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_main.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
security/integrity/ima/ima_api.c +1 -1
@@ -292,7 +292,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, result =ima_calc_file_hash (file, &hash.hdr); } -if (result == -ENOMEM ) +if (result && result != -EBADF && result != -EINVAL ) goto out; length =sizeof (hash.hdr) + hash.hdr.length;
security/integrity/ima/ima_main.c +1 -1
@@ -337,7 +337,7 @@ static int process_measurement(struct file *file, const struct cred *cred, hash_algo =ima_get_hash_algo (xattr_value, xattr_len); rc =ima_collect_measurement (iint, file, buf, size, hash_algo, modsig); -if (rc == -ENOMEM ) +if (rc !=0 && rc != -EBADF && rc != -EINVAL ) goto out_locked;if (!pathbuf)/* ima_rdwr_violation possibly pre-fetched */
Signature · 3 lines
2.39.0.314.g84b9a713c41-goog /M
Hey Mimi,
Just a gentle ping on this one.
Quoted 39 lines · Matt Bobrowski
Restore the error handling logic so that when file measurement fails, the respective iint entry is not left with the digest data being populated with zeroes.
Fixes 54f03916fb89 ("ima: permit fsverity's file digests in the IMA measurement list")Signed-off-by Matt Bobrowski <[email protected]>--- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_main.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)security/integrity/ima/ima_api.c +1
-1@@ -292,7 +292,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, result =ima_calc_file_hash (file, &hash.hdr); } -if (result == -ENOMEM ) +if (result && result != -EBADF && result != -EINVAL ) goto out; length =sizeof (hash.hdr) + hash.hdr.length;security/integrity/ima/ima_main.c +1
-1@@ -337,7 +337,7 @@ static int process_measurement(struct file *file, const struct cred *cred, hash_algo =ima_get_hash_algo (xattr_value, xattr_len); rc =ima_collect_measurement (iint, file, buf, size, hash_algo, modsig); -if (rc == -ENOMEM ) +if (rc !=0 && rc != -EBADF && rc != -EINVAL ) goto out_locked;if (!pathbuf)/* ima_rdwr_violation possibly pre-fetched */ Signature · 1 line
2.39.0.314.g84b9a713c41-goog
/M
Mimi Zohar
maintainerHi Matt,
Quoted 11 lines · Matt Bobrowski
Hey Mimi,
Just a gentle ping on this one.
Quoted 6 lines · Matt Bobrowski
Restore the error handling logic so that when file measurement fails, the respective iint entry is not left with the digest data being populated with zeroes.
Fixes 54f03916fb89 ("ima: permit fsverity's file digests in the IMA measurement list")Signed-off-by Matt Bobrowski <[email protected]>
As of Friday, they're both queued in the next-integrity branch and in linux-next shortly.
Signature · 3 lines
thanks, Mimi
Quoted 12 lines · Mimi Zohar
Hi Matt,
Quoted 9 lines · Matt Bobrowski
Hey Mimi,
Just a gentle ping on this one.
Quoted 4 lines · Matt Bobrowski
Restore the error handling logic so that when file measurement fails, the respective iint entry is not left with the digest data being populated with zeroes.
Quoted 5 lines
Quoted 2 lines
Quoted 2 lines
Fixes 54f03916fb89 ("ima: permit fsverity's file digests in the IMA measurement list")Signed-off-by Matt Bobrowski <[email protected]>As of Friday, they're both queued in the next-integrity branch and in linux-next shortly.
Oh, cool. I should've checked your tree before reaching out. Thanks for the confirmation though.
/M