On Tue, 2026-07-07 at 15:25 +0000, Enrico Bravi wrote:
> On Mon, 2026-07-06 at 23:03 -0400, Mimi Zohar wrote
> > ima_match_rule_data() should only be called for buffer measurements, when
> > there
> > is no inode.
> >
> > + return ((rule->func == func) && !inode &&
> > ima_match_rule_data(rule, func_data, cred));
>
> I was thinking that in this way, it would not trigger the measurement when
> loading the policy from a file. If inode is not NULL, it directly returns
> false
> instead of continuing. What do you thing of something like this:
>
> switch (func) {
> + case POLICY_CHECK:
> + if (inode)
> + break;
> + fallthrough;
> case KEY_CHECK:
> case CRITICAL_DATA:
> return ((rule->func == func) &&
> ima_match_rule_data(rule, func_data, cred));
Yes, your version is clearer.
Mimi
