• Tyler Hicks's avatar
    ima: Move comprehensive rule validation checks out of the token parser · 30031b0e
    Tyler Hicks authored
    Use ima_validate_rule(), at the end of the token parsing stage, to
    verify combinations of actions, hooks, and flags. This is useful to
    increase readability by consolidating such checks into a single function
    and also because rule conditionals can be specified in arbitrary order
    making it difficult to do comprehensive rule validation until the entire
    rule has been parsed.
    
    This allows for the check that ties together the "keyrings" conditional
    with the KEY_CHECK function hook to be moved into the final rule
    validation.
    
    The modsig check no longer needs to compiled conditionally because the
    token parser will ensure that modsig support is enabled before accepting
    "imasig|modsig" appraise type values. The final rule validation will
    ensure that appraise_type and appraise_flag options are only present in
    appraise rules.
    
    Finally, this allows for the check that ties together the "pcr"
    conditional with the measure action to be moved into the final rule
    validation.
    Signed-off-by: default avatarTyler Hicks <tyhicks@linux.microsoft.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    30031b0e
ima.h 13.3 KB