[systemd-devel] [PATCH] ima-setup: write policy one line at a time

[Zbigniew Jędrzejewski-Szmek]

On Thu, Jun 11, 2015 at 01:16:47AM +0200, Lennart Poettering wrote:
> On Wed, 10.06.15 15:38, Zbigniew Jędrzejewski-Szmek (zbyszek at in.waw.pl) wrote:
> 
> > ima_write_policy() expects data to be written as one or more
> > rules, no more than PAGE_SIZE at a time. Easiest way to ensure
> > that we are not splitting rules is to read and write on line at
> > a time.
> > 
> > https://bugzilla.redhat.com/show_bug.cgi?id=1226948
> > ---
> >  src/core/ima-setup.c | 39 +++++++++++++++++----------------------
> >  1 file changed, 17 insertions(+), 22 deletions(-)
> > 
> > diff --git a/src/core/ima-setup.c b/src/core/ima-setup.c
> > index 4d8b638115..5b3d16cd31 100644
> > --- a/src/core/ima-setup.c
> > +++ b/src/core/ima-setup.c
> > @@ -23,9 +23,6 @@
> >  
> >  #include <unistd.h>
> >  #include <errno.h>
> > -#include <fcntl.h>
> > -#include <sys/stat.h>
> > -#include <sys/mman.h>
> >  
> >  #include "ima-setup.h"
> >  #include "util.h"
> > @@ -36,20 +33,19 @@
> >  #define IMA_POLICY_PATH "/etc/ima/ima-policy"
> >  
> >  int ima_setup(void) {
> > -        int r = 0;
> > -
> >  #ifdef HAVE_IMA
> > -        _cleanup_close_ int policyfd = -1, imafd = -1;
> > -        struct stat st;
> > -        char *policy;
> > +        _cleanup_fclose_ FILE *input = NULL;
> > +        _cleanup_close_ int imafd = -1;
> > +        char line[LINE_MAX];
> 
> Hmm, I wonder if this might bite us. LINE_MAX is a good choice as max
> line length for formats we define in systemd, but the question of
> course is what the the max line length is for IMA...
It's PAGE_SIZE ;) Making this dynamic doesn't make much sense to me,
but we could make it 4096, as this is the lowest (and common) size.

Zbyszek