diff mbox series

[v1,4/5] ima-evm-utils: Allow multiple files in ima_verify

Message ID 20190707234837.4866-5-vt@altlinux.org (mailing list archive)
State New, archived
Headers show
Series ima-evm-utils: Assorted fixes and improvements | expand

Commit Message

Vitaly Chikunov July 7, 2019, 11:48 p.m. UTC 
This allows testing multiple verify in a row, similar to ima_measurement.

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---
 src/evmctl.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Comments

Vitaly Chikunov July 27, 2019, 2:49 a.m. UTC | #1 
Mimi,

On Mon, Jul 08, 2019 at 02:48:36AM +0300, Vitaly Chikunov wrote:
> This allows testing multiple verify in a row, similar to ima_measurement.
> 
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> ---
>  src/evmctl.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/src/evmctl.c b/src/evmctl.c
> index fac593a..7ce2022 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -850,9 +850,11 @@ static int cmd_verify_ima(struct command *cmd)
>  		return -1;
>  	}
>  
> -	err = verify_ima(file);
> -	if (!err && params.verbose >= LOG_INFO)
> -		log_info("%s: verification is OK\n", file);
> +	do {
> +		err = verify_ima(file);
> +		if (!err && params.verbose >= LOG_INFO)
> +			log_info("%s: verification is OK\n", file);
> +	} while ((file = g_argv[optind++]));

Currently `err' is affected only by the last verified file. But I think
value of err should be affected by results from all files. But how?
Should we AND verification results or OR? I think it should be ANDed and
will send new version of this patch.

Thanks,

>  	return err;
>  }
>  
> -- 
> 2.11.0
diff mbox series

Patch

diff --git a/src/evmctl.c b/src/evmctl.c
index fac593a..7ce2022 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -850,9 +850,11 @@  static int cmd_verify_ima(struct command *cmd)
 		return -1;
 	}
 
-	err = verify_ima(file);
-	if (!err && params.verbose >= LOG_INFO)
-		log_info("%s: verification is OK\n", file);
+	do {
+		err = verify_ima(file);
+		if (!err && params.verbose >= LOG_INFO)
+			log_info("%s: verification is OK\n", file);
+	} while ((file = g_argv[optind++]));
 	return err;
 }