diff options
| author | Eric Paris <eparis@redhat.com> | 2010-04-20 10:21:24 -0400 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2010-04-21 09:58:16 +1000 |
| commit | 7233e3ee22b1506723411fe437bcf69f678e8cdd (patch) | |
| tree | 3d84d037890a9918ed02b89fde875fd6e6cd3b10 /security/integrity | |
| parent | 28ef4002ec7b4be27f1110b83e255df8159c786a (diff) | |
IMA: handle comments in policy
IMA policy load parser will reject any policies with a comment. This patch
will allow the parser to just ignore lines which start with a #. This is not
very robust. # can ONLY be used at the very beginning of a line. Inline
comments are not allowed.
Signed-off-by: Eric Paris
Acked-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/integrity')
| -rw-r--r-- | security/integrity/ima/ima_policy.c | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 1bc9e31ae250..babc5009756d 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -445,19 +445,26 @@ ssize_t ima_parse_add_rule(char *rule) p = strsep(&rule, "\n"); len = strlen(p) + 1; + + if (*p == '#') { + kfree(entry); + return len; + } + result = ima_parse_rule(p, entry); - if (!result) { - result = len; - mutex_lock(&ima_measure_mutex); - list_add_tail(&entry->list, &measure_policy_rules); - mutex_unlock(&ima_measure_mutex); - } else { + if (result) { kfree(entry); integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, op, "invalid policy", result, audit_info); + return result; } - return result; + + mutex_lock(&ima_measure_mutex); + list_add_tail(&entry->list, &measure_policy_rules); + mutex_unlock(&ima_measure_mutex); + + return len; } /* ima_delete_rules called to cleanup invalid policy */ |