integrity: Small code improvements

These changes are too small to warrant their own patches:

The keyid and sig_size members of struct signature_v2_hdr are in BE format,
so use a type that makes this assumption explicit. Also, use beXX_to_cpu
instead of __beXX_to_cpu to read them.

Change integrity_kernel_read to take a void * buffer instead of char *
buffer, so that callers don't have to use a cast if they provide a buffer
that isn't a char *.

Add missing #endif comment in ima.h pointing out which macro it refers to.

Add missing fall through comment in ima_appraise.c.

Constify mask_tokens and func_tokens arrays.

Signed-off-by: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index 80052ed8d4673c8abfb0c219bba47562003dde74..ab6a029062a18ba8db3728f2e96e04de28e6c15a 100644 (file)
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -92,13 +92,13 @@ int asymmetric_verify(struct key *keyring, const char *sig,
 
        siglen -= sizeof(*hdr);
 
-       if (siglen != __be16_to_cpu(hdr->sig_size))
+       if (siglen != be16_to_cpu(hdr->sig_size))
                return -EBADMSG;
 
        if (hdr->hash_algo >= HASH_ALGO__LAST)
                return -ENOPKG;
 
-       key = request_asymmetric_key(keyring, __be32_to_cpu(hdr->keyid));
+       key = request_asymmetric_key(keyring, be32_to_cpu(hdr->keyid));
        if (IS_ERR(key))
                return PTR_ERR(key);
 

diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index c710d22042f96c4e9d42a73943ce2d8f2689f89f..6fc888ca468e4f9cdd8938e535ebd4e2dbbe2044 100644 (file)
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -182,7 +182,7 @@ security_initcall(integrity_iintcache_init);
  *
  */
 int integrity_kernel_read(struct file *file, loff_t offset,
-                         char *addr, unsigned long count)
+                         void *addr, unsigned long count)
 {
        mm_segment_t old_fs;
        char __user *buf = (char __user *)addr;

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index d26a30e37d13a1ac0c049dd27dc9586aba9c9315..215a93c41b5137ccedabe30d7497403ef211338e 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -284,7 +284,7 @@ static inline int ima_read_xattr(struct dentry *dentry,
        return 0;
 }
 
-#endif
+#endif /* CONFIG_IMA_APPRAISE */
 
 /* LSM based policy rules require audit */
 #ifdef CONFIG_IMA_LSM_RULES

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 7fe0566142d8bd470286f5462a5221ac8a5ac937..ea36a4f134f4a3332226240f2e768c1a764a438a 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -240,6 +240,7 @@ int ima_appraise_measurement(enum ima_hooks func,
        case IMA_XATTR_DIGEST_NG:
                /* first byte contains algorithm id */
                hash_start = 1;
+               /* fall through */
        case IMA_XATTR_DIGEST:
                if (iint->flags & IMA_DIGSIG_REQUIRED) {
                        cause = "IMA-signature-required";

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 0acd68decb177f31a50841d1f7fd3d67a539f884..949ad385832731e62e469535700701c8fab971a7 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -965,7 +965,7 @@ enum {
        mask_exec = 0, mask_write, mask_read, mask_append
 };
 
-static char *mask_tokens[] = {
+static const char *const mask_tokens[] = {
        "MAY_EXEC",
        "MAY_WRITE",
        "MAY_READ",
@@ -979,7 +979,7 @@ enum {
        func_policy
 };
 
-static char *func_tokens[] = {
+static const char *const func_tokens[] = {
        "FILE_CHECK",
        "MMAP_CHECK",
        "BPRM_CHECK",

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 24520b4ef3b081887f15d660aac17371fe6c9788..a53e7e4ab06c74d4ca4c85836f1e0d2e809433a6 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -92,8 +92,8 @@ struct signature_v2_hdr {
        uint8_t type;           /* xattr type */
        uint8_t version;        /* signature format version */
        uint8_t hash_algo;      /* Digest algorithm [enum hash_algo] */
-       uint32_t keyid;         /* IMA key identifier - not X509/PGP specific */
-       uint16_t sig_size;      /* signature size */
+       __be32 keyid;           /* IMA key identifier - not X509/PGP specific */
+       __be16 sig_size;        /* signature size */
        uint8_t sig[0];         /* signature payload */
 } __packed;
 
@@ -118,7 +118,8 @@ struct integrity_iint_cache {
 struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 
 int integrity_kernel_read(struct file *file, loff_t offset,
-                         char *addr, unsigned long count);
+                         void *addr, unsigned long count);
+
 int __init integrity_read_file(const char *path, char **data);
 
 #define INTEGRITY_KEYRING_EVM          0