Messages in this thread | | | Subject | Re: [PATCH 6/6] Integrity: IMA file free imbalance | From | Mimi Zohar <> | Date | Mon, 02 Feb 2009 20:27:54 -0500 |
| |
On Mon, 2009-02-02 at 17:47 -0600, Serge E. Hallyn wrote: > Quoting Mimi Zohar (zohar@linux.vnet.ibm.com): > > The number of calls to ima_path_check()/ima_file_free() > > should be balanced. An extra call to fput(), indicates > > the file could have been accessed without first being > > measured. > > > > Although f_count is incremented/decremented in places other > > than fget/fput, like fget_light/fput_light and get_file, the > > current task must already hold a file refcnt. The call to > > __fput() is delayed until the refcnt becomes 0, resulting > > in ima_file_free() flagging any changes. > > > > - add hook to increment opencount for IPC shared memory(SYSV) > > and shmat files > > > > Signed-off-by: Mimi Zohar <zohar@us.ibm.com> > > ... > > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > > ... > > > +static void opencount_get(struct file *file) > > +{ > > + struct inode *inode = file->f_dentry->d_inode; > > + struct ima_iint_cache *iint; > > + > > + if (!ima_initialized || !S_ISREG(inode->i_mode)) > > + return; > > + iint = ima_iint_find_insert_get(inode); > > + mutex_lock(&iint->mutex); > > + if (iint) > > Hey, I think you've got those two lines above mixed > up a bit :)
yes, thanks!
> Very neat, though. > > Acked-by: Serge Hallyn <serue@us.ibm.com> > > once that's fixed up. > > thanks, > -serge
| |