Messages in this thread Patch in this message | | | From | Dmitry Kasatkin <> | Subject | [PATCH v1 2/4] integrity: provide file reading API | Date | Tue, 15 Jul 2014 15:54:21 +0300 |
| |
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> --- security/integrity/Kconfig | 3 +++ security/integrity/digsig.c | 41 +++++++++++++++++++++++++++++++++++++++++ security/integrity/integrity.h | 2 +- 3 files changed, 45 insertions(+), 1 deletion(-)
diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 463219b..1f000c4 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -50,6 +50,9 @@ config INTEGRITY_AUDIT be enabled by specifying 'integrity_audit=1' on the kernel command line. +config INTEGRITY_FILE_READ + def_bool n + source security/integrity/ima/Kconfig source security/integrity/evm/Kconfig diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 8d4fbff..85d6662 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -18,6 +18,8 @@ #include <linux/cred.h> #include <linux/key-type.h> #include <linux/digsig.h> +#include <linux/slab.h> +#include <linux/file.h> #include "integrity.h" @@ -63,6 +65,45 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, return -EOPNOTSUPP; } +#ifdef CONFIG_INTEGRITY_FILE_READ +int integrity_read_file(const char *path, char **data) +{ + struct file *file; + loff_t size; + char *buf; + int rc = -EINVAL; + + file = filp_open(path, O_RDONLY, 0); + if (IS_ERR(file)) { + rc = PTR_ERR(file); + pr_err("Unable to open file: %s (%d)", path, rc); + return rc; + } + + size = i_size_read(file_inode(file)); + if (size <= 0) + goto out; + + buf = kmalloc(size, GFP_KERNEL); + if (!buf) { + rc = -ENOMEM; + goto out; + } + + /* should be ima_kernel_read */ + rc = kernel_read(file, 0, buf, size); + if (rc < 0) + kfree(buf); + else if (rc != size) + rc = -EIO; + else + *data = buf; +out: + fput(file); + return rc; +} +#endif + int integrity_init_keyring(const unsigned int id) { const struct cred *cred = current_cred(); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 7656d47..f77de68 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -130,7 +130,7 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode); int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, const char *digest, int digestlen); - +int integrity_read_file(const char *path, char **data); int integrity_init_keyring(const unsigned int id); #else -- 1.9.1
| |