* [PATCH v3] ima: silence measurement list hexdump during kexec
@ 2021-12-27 14:52 Bruno Meneguele
2021-12-27 15:54 ` Mimi Zohar
0 siblings, 1 reply; 2+ messages in thread
From: Bruno Meneguele @ 2021-12-27 14:52 UTC (permalink / raw)
To: zohar; +Cc: linux-integrity, linux-kernel, Bruno Meneguele
The measurement list is being dumped during soft resets (kexec) through the
call to print_hex_dump(KERN_DEBUG, ...) without considering the DEBUG
compilation flag. With that, to avoid dumping this information to the system
log whenever a soft reset happens during boot process, since the default
console loglevel is generally set to 7 (debug) during boot, guard the call
to print_hex_dump() with #ifdef for the DEBUG cflag.
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
Changelog:
- v2: guard call with #ifdef instead of using print_hex_dump_debug, which
would not completely solve the case.
- v1: update commit log with more information.
security/integrity/ima/ima_kexec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
index f799cc278a9a..2d6db5fbda41 100644
--- a/security/integrity/ima/ima_kexec.c
+++ b/security/integrity/ima/ima_kexec.c
@@ -61,9 +61,11 @@ static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
}
memcpy(file.buf, &khdr, sizeof(khdr));
+#if defined(DEBUG)
print_hex_dump(KERN_DEBUG, "ima dump: ", DUMP_PREFIX_NONE,
16, 1, file.buf,
file.count < 100 ? file.count : 100, true);
+#endif
*buffer_size = file.count;
*buffer = file.buf;
--
2.33.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v3] ima: silence measurement list hexdump during kexec
2021-12-27 14:52 [PATCH v3] ima: silence measurement list hexdump during kexec Bruno Meneguele
@ 2021-12-27 15:54 ` Mimi Zohar
0 siblings, 0 replies; 2+ messages in thread
From: Mimi Zohar @ 2021-12-27 15:54 UTC (permalink / raw)
To: Bruno Meneguele; +Cc: linux-integrity, linux-kernel
On Mon, 2021-12-27 at 11:52 -0300, Bruno Meneguele wrote:
> The measurement list is being dumped during soft resets (kexec) through the
> call to print_hex_dump(KERN_DEBUG, ...) without considering the DEBUG
> compilation flag. With that, to avoid dumping this information to the system
> log whenever a soft reset happens during boot process, since the default
> console loglevel is generally set to 7 (debug) during boot, guard the call
> to print_hex_dump() with #ifdef for the DEBUG cflag.
The patch description needs to be rewritten/simplified. If the only
problem is that "the console loglevel is generally set to 7 (debug)",
why not begin with the patch description with that?
Other things to consider including in the patch description:
- any side effects of the change (e.g. ability to dynamically enable
output)?
thanks,
Mimi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-12-27 15:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-27 14:52 [PATCH v3] ima: silence measurement list hexdump during kexec Bruno Meneguele
2021-12-27 15:54 ` Mimi Zohar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).