lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 201/542] IMA: Check IMA policy flag
    Date
    From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>

    [ Upstream commit c5563bad88e07017e08cce1142903e501598c80c ]

    process_buffer_measurement() may be called prior to IMA being
    initialized (for instance, when the IMA hook is called when
    a key is added to the .builtin_trusted_keys keyring), which
    would result in a kernel panic.

    This patch adds the check in process_buffer_measurement()
    to return immediately if IMA is not initialized yet.

    Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/integrity/ima/ima_main.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index d7e987baf1274..9b35db2fc777a 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -655,6 +655,9 @@ void process_buffer_measurement(const void *buf, int size,
    int action = 0;
    u32 secid;

    + if (!ima_policy_flag)
    + return;
    +
    /*
    * Both LSM hooks and auxilary based buffer measurements are
    * based on policy. To avoid code duplication, differentiate
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 19:12    [W:6.344 / U:0.292 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site