Re: [PATCH v4 2/2] ima: measure buffer sent to securityfs policy file

On Mon, 2026-06-29 at 09:26 +0000, Enrico  Bravi wrote:
> > > diff --git a/security/integrity/ima/ima_fs.c
> > > b/security/integrity/ima/ima_fs.c
> > > index 65e7812c702f..a277c9135944 100644
> > > --- a/security/integrity/ima/ima_fs.c
> > > +++ b/security/integrity/ima/ima_fs.c
> > > @@ -356,6 +356,7 @@ static ssize_t ima_write_policy(struct file *file, const
> > > char __user *buf,
> > >  				    1, 0);
> > >  		result = -EACCES;
> > >  	} else {
> > > +		ima_measure_policy_buf(data, datalen);
> > 
> > Should failure to measure the input policy rules be audited?
> 
> process_buffer_measurement() is already auditing in case of failure before
> returning. Do you think it is necessary to audit also at this point?

No, you're correct.

> 
> > >  		result = ima_parse_add_rule(data);
> > >  	}
> > >  	mutex_unlock(&ima_write_mutex);
> > > diff --git a/security/integrity/ima/ima_main.c
> > > b/security/integrity/ima/ima_main.c
> > > index 5cea53fc36df..599495304712 100644
> > > --- a/security/integrity/ima/ima_main.c
> > > +++ b/security/integrity/ima/ima_main.c
> > > @@ -1221,6 +1221,25 @@ int ima_measure_critical_data(const char
> > > *event_label,
> > >  }
> > >  EXPORT_SYMBOL_GPL(ima_measure_critical_data);
> > >  
> > > +/**
> > > + * ima_measure_policy_buf - Measure the policy write buffer
> > 
> > Consider renaming this function to ima_measure_policy_input(), which parallels
> > the function ima_measure_loaded_policy() in the first patch.
> 
> My intention with the previous ima_measure_policy_write() name was to highlight
> the fact it is not measuring every data sent to the policy file. For example,
> writing the path of the file from which reading the new policy does not trigger
> this measurement. Eventually, what do you think of ima_measure_raw_policy() or
> ima_measure_unparsed_policy()?

The policy could have comment lines, which are being measured.  Naming the
function ima_measure_raw_policy() is perfect.

> 
thanks,

Mimi