Re: [PATCH v9 5/8] ima: make process_buffer_measurement() generic

[Lakshmi Ramasubramanian]

On 10/23/19 8:47 PM, Nayna Jain wrote:

Hi Nayna,

> process_buffer_measurement() is limited to measuring the kexec boot
> command line. This patch makes process_buffer_measurement() more
> generic, allowing it to measure other types of buffer data (e.g.
> blacklisted binary hashes or key hashes).

Now that process_buffer_measurement() is being made generic to measure 
any buffer, it would be good to add a tag to indicate what type of 
buffer is being measured.

For example, if the buffer is kexec command line the log could look like:

 "kexec_cmdline: <command line data>"

Similarly, if the buffer is blacklisted binary hash:

 "blacklist hash: <data>".

If the buffer is key hash:

 "<name of the keyring>: key data".

This would greatly help the consumer of the IMA log to know the type of 
data represented in each IMA log entry.

thanks,
 -lakshmi