Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7233e3ee authored by Eric Paris's avatar Eric Paris Committed by James Morris
Browse files

IMA: handle comments in policy 



IMA policy load parser will reject any policies with a comment.  This patch
will allow the parser to just ignore lines which start with a #.  This is not
very robust.  # can ONLY be used at the very beginning of a line.  Inline
comments are not allowed.

Signed-off-by: Eric Paris
Acked-by: default avatarMimi Zohar <zohar@us.ibm.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 28ef4002

security/integrity/ima/ima_policy.c

+14 −7
Original line number Diff line number Diff line
@@ -445,21 +445,28 @@ ssize_t ima_parse_add_rule(char *rule) 


	p = strsep(&rule, "\n");

	len = strlen(p) + 1;



	if (*p == '#') {

		kfree(entry);

		return len;

	}



	result = ima_parse_rule(p, entry);

	if (!result) {

		result = len;

		mutex_lock(&ima_measure_mutex);

		list_add_tail(&entry->list, &measure_policy_rules);

		mutex_unlock(&ima_measure_mutex);

	} else {

	if (result) {

		kfree(entry);

		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,

				    NULL, op, "invalid policy", result,

				    audit_info);

	}

		return result;

	}



	mutex_lock(&ima_measure_mutex);

	list_add_tail(&entry->list, &measure_policy_rules);

	mutex_unlock(&ima_measure_mutex);



	return len;

}



/* ima_delete_rules called to cleanup invalid policy */

void ima_delete_rules(void)

{