| Message ID | 20200817215233.95319-5-bmeneg@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | integrity: improve user feedback for invalid bootparams | expand |
On Mon, 2020-08-17 at 18:52 -0300, Bruno Meneguele wrote: > Depending on the IMA policy a key can be searched in multiple keyrings (e.g. > .ima and .platform) and possibly failing for both. However, for the user not > aware of the searching order it's not clear what's the keyring the kernel > didn't find the key. With this patch we improve this feedback by printing > the keyring "description" (name). > > Signed-off-by: Bruno Meneguele <bmeneg@redhat.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c index cfa4127d0518..14de98ef67f6 100644 --- a/security/integrity/digsig_asymmetric.c +++ b/security/integrity/digsig_asymmetric.c @@ -55,8 +55,14 @@ static struct key *request_asymmetric_key(struct key *keyring, uint32_t keyid) } if (IS_ERR(key)) { - pr_err_ratelimited("Request for unknown key '%s' err %ld\n", - name, PTR_ERR(key)); + if (keyring) + pr_err_ratelimited("Request for unknown key '%s' in '%s' keyring. err %ld\n", + name, keyring->description, + PTR_ERR(key)); + else + pr_err_ratelimited("Request for unknown key '%s' err %ld\n", + name, PTR_ERR(key)); + switch (PTR_ERR(key)) { /* Hide some search errors */ case -EACCES:
Depending on the IMA policy a key can be searched in multiple keyrings (e.g. .ima and .platform) and possibly failing for both. However, for the user not aware of the searching order it's not clear what's the keyring the kernel didn't find the key. With this patch we improve this feedback by printing the keyring "description" (name). Signed-off-by: Bruno Meneguele <bmeneg@redhat.com> --- security/integrity/digsig_asymmetric.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)