ima: Return int in the functions to measure a buffer
authorRoberto Sassu <roberto.sassu@huawei.com>
Fri, 23 Jul 2021 08:53:03 +0000 (10:53 +0200)
committerMimi Zohar <zohar@linux.ibm.com>
Fri, 23 Jul 2021 13:27:02 +0000 (09:27 -0400)
commitce5bb5a86e5ebcd3c2e40e6dd1382027b5d43caf
tree93fde4a707aaeec18ba7e63f2b863b444349dfef
parent5d1ef2ce13a9098b4e0d31c50e4c79763a57b444
ima: Return int in the functions to measure a buffer

ima_measure_critical_data() and process_buffer_measurement() currently
don't return a result as, unlike appraisal-related functions, the result is
not used by callers to deny an operation. Measurement-related functions
instead rely on the audit subsystem to notify the system administrator when
an error occurs.

However, ima_measure_critical_data() and process_buffer_measurement() are a
special case, as these are the only functions that can return a buffer
measurement (for files, there is ima_file_hash()). In a subsequent patch,
they will be modified to return the calculated digest.

In preparation to return the result of the digest calculation, this patch
modifies the return type from void to int, and returns 0 if the buffer has
been successfully measured, a negative value otherwise.

Given that the result of the measurement is still not necessary, this patch
does not modify the behavior of existing callers by processing the returned
value. For those, the return value is ignored.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Acked-by: Paul Moore <paul@paul-moore.com> (for the SELinux bits)
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
include/linux/ima.h
security/integrity/ima/ima.h
security/integrity/ima/ima_main.c