Messages in this thread | | | Date | Mon, 2 Feb 2009 17:47:02 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH 6/6] Integrity: IMA file free imbalance |
| |
Quoting Mimi Zohar (zohar@linux.vnet.ibm.com): > The number of calls to ima_path_check()/ima_file_free() > should be balanced. An extra call to fput(), indicates > the file could have been accessed without first being > measured. > > Although f_count is incremented/decremented in places other > than fget/fput, like fget_light/fput_light and get_file, the > current task must already hold a file refcnt. The call to > __fput() is delayed until the refcnt becomes 0, resulting > in ima_file_free() flagging any changes. > > - add hook to increment opencount for IPC shared memory(SYSV) > and shmat files > > Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
...
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
...
> +static void opencount_get(struct file *file) > +{ > + struct inode *inode = file->f_dentry->d_inode; > + struct ima_iint_cache *iint; > + > + if (!ima_initialized || !S_ISREG(inode->i_mode)) > + return; > + iint = ima_iint_find_insert_get(inode); > + mutex_lock(&iint->mutex); > + if (iint)
Hey, I think you've got those two lines above mixed up a bit :)
Very neat, though.
Acked-by: Serge Hallyn <serue@us.ibm.com>
once that's fixed up.
thanks, -serge
| |