Re: [PATCH 8/9] ABI: security: fix location for evm and ima_policy

[Mauro Carvalho Chehab]

Em Thu, 09 Sep 2021 09:48:11 -0400
Mimi Zohar <zohar@xxxxxxxxxxxxx> escreveu:

> Hi Mauro,
> 
> On Wed, 2021-09-08 at 16:58 +0200, Mauro Carvalho Chehab wrote:
> > The What: definitions there are wrong, pointing to different
> > locations than what's expected.
> > 
> > Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>  
> 
> What is the purpose for the asterisks in the file path?

That's a standard filesystem wildcard. On ABI documents, there are
some other ways to specify it. The most used ones are:

	/sys/kernel/security/*/evm
	/sys/kernel/security/.../evm
	/sys/kernel/security/<something>/evm

(currently, there's no preferences between them)

If you check patches 1-3, the goal here is to have something
that will be replaced by this regex by scripts/get_abi.pl,
e.g. it will turn into:

	/sys/kernel/security/.*/evm

So, this what:

	What:		/sys/kernel/security/evm /sys/kernel/security/*/evm

Matches all three occurrences of evm on my system:

	/sys/kernel/security/evm
	/sys/kernel/security/integrity/evm
	/sys/kernel/security/integrity/evm/evm

Regards,
Mauro


> 
> thanks,
> 
> Mimi
> 
> > ---
> >  Documentation/ABI/testing/evm        | 4 ++--
> >  Documentation/ABI/testing/ima_policy | 2 +-
> >  2 files changed, 3 insertions(+), 3 deletions(-)
> > 
> > diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
> > index 553fd8a33e56..4b76a19b7bb4 100644
> > --- a/Documentation/ABI/testing/evm
> > +++ b/Documentation/ABI/testing/evm
> > @@ -1,4 +1,4 @@
> > -What:		security/evm
> > +What:		/sys/kernel/security/evm /sys/kernel/security/*/evm
> >  Date:		March 2011
> >  Contact:	Mimi Zohar <zohar@xxxxxxxxxx>
> >  Description:
> > @@ -93,7 +93,7 @@ Description:
> >  		core/ima-setup) have support for loading keys at boot
> >  		time.
> >  
> > -What:		security/integrity/evm/evm_xattrs
> > +What:		/sys/kernel/security/*/evm/evm_xattrs
> >  Date:		April 2018
> >  Contact:	Matthew Garrett <mjg59@xxxxxxxxxx>
> >  Description:
> > diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
> > index 5c2798534950..2d84063d196f 100644
> > --- a/Documentation/ABI/testing/ima_policy
> > +++ b/Documentation/ABI/testing/ima_policy
> > @@ -1,4 +1,4 @@
> > -What:		security/ima/policy
> > +What:		/sys/kernel/security/*/ima/policy
> >  Date:		May 2008
> >  Contact:	Mimi Zohar <zohar@xxxxxxxxxx>
> >  Description:  
> 
>