lkml.org 
[lkml]   [2009]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] IMA: remove read permissions on the ima policy file
    Date
    The IMA policy file does not implement read.  Trying to just open/read/close
    the file will load a blank policy and you cannot then change the policy
    without a reboot. This removes the read permission from the file so one must
    at least be attempting to write...

    Signed-off-by: Eric Paris <eparis@redhat.com>
    ---

    security/integrity/ima/ima_fs.c | 6 +++++-
    1 files changed, 5 insertions(+), 1 deletions(-)

    diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
    index 510186f..2a829da 100644
    --- a/security/integrity/ima/ima_fs.c
    +++ b/security/integrity/ima/ima_fs.c
    @@ -15,6 +15,7 @@
    * implemenents security file system for reporting
    * current measurement list and IMA statistics
    */
    +#include <linux/fcntl.h>
    #include <linux/module.h>
    #include <linux/seq_file.h>
    #include <linux/rculist.h>
    @@ -283,6 +284,9 @@ static atomic_t policy_opencount = ATOMIC_INIT(1);
    */
    int ima_open_policy(struct inode * inode, struct file * filp)
    {
    + /* No point in being allowed to open it if you aren't going to write */
    + if (!(filp->f_flags & O_WRONLY))
    + return -EACCES;
    if (atomic_dec_and_test(&policy_opencount))
    return 0;
    return -EBUSY;
    @@ -349,7 +353,7 @@ int ima_fs_init(void)
    goto out;

    ima_policy = securityfs_create_file("policy",
    - S_IRUSR | S_IRGRP | S_IWUSR,
    + S_IWUSR,
    ima_dir, NULL,
    &ima_measure_policy_ops);
    if (IS_ERR(ima_policy))


    \
     
     \ /
      Last update: 2009-05-12 21:19    [W:0.026 / U:33.792 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site