[PATCH v39 01/42] integrity: disassociate ima_filter_rule from security_audit_rule

[Casey Schaufler]

On 6/24/2024 3:03 PM, Paul Moore wrote:
> On Mon, Jun 24, 2024 at 9:57 AM Mimi Zohar <zohar at linux.ibm.com> wrote:
>> On Mon, 2024-06-24 at 10:45 +0200, Roberto Sassu wrote:
>>> My only comment would be that I would not call the new functions with
>>> the ima_ prefix, being those in security.c, which is LSM agnostic, but
>>> I would rather use a name that more resembles the differences, if any.
>> Commit 4af4662fa4a9 ("integrity: IMA policy") originally referred to these hooks
>> as security_filter_rule_XXXX, but commit b8867eedcf76 ("ima: Rename internal
>> filter rule functions") renamed the function to ima_filter_rule_XXX) to avoid
>> security namespace polution.
>>
>> If these were regular security hooks, the hooks would be named:
>> filter_rule_init, filter_rule_free, filter_rule_match with the matching
>> "security" prefix functions. Audit and IMA would then register the hooks.
>>
>> I agree these functions should probably be renamed again, probably to
>> security_ima_filter_rule_XXXX.
> It's funny, my mind saw that the patch was removing those preprocessor
> macros and was so happy it must have shut off, because we already have
> security_XXX functions for these :)
>
> See security_audit_rule_init(), security_audit_rule_free(), and
> security_audit_rule_match().
>
> Casey, do you want to respin this patch to use the existing LSM
> functions?

If you want to use shared functions they shouldn't be security_audit_blah().
I like Mimi's suggestion. Rename security_audit_filter_rule_init() to
security_filter_rule_init() and use that in both places.

>   It looks like you should have Mimi's and Roberto's support
> in this.  Please submit this as a standalone patch as it really is a
> IMA/LSM cleanup.
>
> Thanks all.
>