lkml.org 
[lkml]   [2010]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH 1/3] evm: added flag IMA_NEW in the integrity_iint_cache structure
From
Date
The flag IMA_NEW is set in the function evm_inode_post_init_security()
to distinguish between new and existent files and it is cleared in the
function ima_dec_counts(). This permits to check/fix the 'security.ima'
extended attribute properly in the function ima_appraise_measurement()
without verifying the 'version' field of the 'integrity_iint_cache'
structure.
The 'i_version' field of the inode is not suitable for determining if a
file is being created because the value '1' may be assumed by inodes
already in the filesystem before mounting the same with the parameter
'iversion' as well as those newly created.

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
---
security/integrity/evm/evm_main.c | 23 ++++++++++++++++++++---
security/integrity/ima/ima_appraise.c | 2 +-
security/integrity/ima/ima_main.c | 2 +-
security/integrity/integrity.h | 1 +
4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index cca6410..db5e66f 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -274,14 +274,25 @@ int evm_inode_post_init_security(struct inode *inode, const struct xattr *lsm_xa
{
u8 *hmac_val;
int rc;
+ struct integrity_iint_cache *iint;

if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name))
return -EOPNOTSUPP;

- hmac_val = kzalloc(MAX_DIGEST_SIZE, GFP_NOFS);
- if (!hmac_val)
+ iint = integrity_iint_find_get(inode);
+ if (!iint)
return -ENOMEM;

+ mutex_lock(&iint->mutex);
+ iint->flags |= IMA_NEW;
+ mutex_unlock(&iint->mutex);
+
+ hmac_val = kzalloc(MAX_DIGEST_SIZE, GFP_NOFS);
+ if (!hmac_val) {
+ rc = -ENOMEM;
+ goto outnofree;
+ }
+
rc = evm_init_hmac(inode, lsm_xattr, hmac_val);
if (rc < 0)
goto out;
@@ -289,9 +300,15 @@ int evm_inode_post_init_security(struct inode *inode, const struct xattr *lsm_xa
evm_xattr->value = hmac_val;
evm_xattr->value_len = evm_hmac_size;
evm_xattr->name = XATTR_EVM_SUFFIX;
- return 0;
+ goto outrelease;
out:
kfree(hmac_val);
+outnofree:
+ mutex_lock(&iint->mutex);
+ iint->flags &= ~IMA_NEW;
+ mutex_unlock(&iint->mutex);
+outrelease:
+ kref_put(&iint->refcount, iint_free);
return rc;
}
EXPORT_SYMBOL_GPL(evm_inode_post_init_security);
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index fb402fa..b0256e6 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -114,7 +114,7 @@ int ima_appraise_measurement(struct integrity_iint_cache *iint,
return status;
err_out:
if (rc == -ENODATA) {
- if (iint->version == 1)
+ if (iint->flags & IMA_NEW)
return 0;
cause = "missing-hash";
if (ima_appraise & IMA_APPRAISE_FIX)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 14c39a5..cd29bf2 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -197,7 +197,7 @@ static void ima_dec_counts(struct integrity_iint_cache *iint,
if (iint->writecount == 0) {
if (iint->version != inode->i_version) {
iint->flags &= ~(IMA_COLLECTED | IMA_APPRAISED
- | IMA_MEASURED);
+ | IMA_MEASURED | IMA_NEW);
if (iint->flags & IMA_APPRAISE)
ima_update_xattr(iint, file);
}
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 3a9b3de..a25b019 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -23,6 +23,7 @@
#define IMA_APPRAISE 4
#define IMA_APPRAISED 8
#define IMA_COLLECTED 16
+#define IMA_NEW 32

/* integrity data associated with an inode */
struct integrity_iint_cache {
--
1.7.2.3
[unhandled content-type:application/pkcs7-signature]
\
 
 \ /
  Last update: 2010-11-02 11:09    [W:0.168 / U:0.276 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site