lkml.org 
[lkml]   [2020]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[RFC PATCH 17/30] ima: Add the violation counter to the namespace
Date
From: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>

The violations are now tracked per namespace.

Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
---
include/linux/ima.h | 1 +
security/integrity/ima/ima.h | 1 -
security/integrity/ima/ima_api.c | 2 +-
security/integrity/ima/ima_fs.c | 18 +++++++++++++++---
security/integrity/ima/ima_init.c | 1 +
security/integrity/ima/ima_ns.c | 1 +
security/integrity/ima/ima_queue.c | 1 -
7 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/include/linux/ima.h b/include/linux/ima.h
index d59ed38a4305..7eb7a008c5fe 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -204,6 +204,7 @@ struct ima_namespace {
struct integrity_iint_tree *iint_tree;
struct list_head *measurements;
atomic_long_t ml_len; /* number of stored measurements in the list */
+ atomic_long_t violations;
} __randomize_layout;

extern struct ima_namespace init_ima_ns;
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 7318fff3ccaa..ef95522cc710 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -193,7 +193,6 @@ extern spinlock_t ima_queue_lock;

struct ima_h_table {
atomic_long_t len; /* number of stored measurements in the list */
- atomic_long_t violations;
struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
};
extern struct ima_h_table ima_htable;
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index b01451b34a98..f91516885033 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -151,7 +151,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
event_data.ns_id = get_ns_id(ima_ns);

/* can overflow, only indicator */
- atomic_long_inc(&ima_htable.violations);
+ atomic_long_inc(&ima_ns->violations);

result = ima_alloc_init_template(&event_data, &entry, NULL);
if (result < 0) {
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 6d370874d80f..b71c2552ac15 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -51,10 +51,23 @@ static ssize_t ima_show_htable_violations(struct file *filp,
char __user *buf,
size_t count, loff_t *ppos)
{
- return ima_show_htable_value(buf, count, ppos, &ima_htable.violations);
+ struct ima_namespace *ima_ns = get_current_ns();
+
+ return ima_show_htable_value(buf, count, ppos, &ima_ns->violations);
+}
+
+static int ima_open_htable_violations(struct inode *inode, struct file *file)
+{
+ struct ima_namespace *ima_ns = get_current_ns();
+
+ if (!ns_capable(ima_ns->user_ns, CAP_SYS_ADMIN))
+ return -EPERM;
+
+ return 0;
}

static const struct file_operations ima_htable_violations_ops = {
+ .open = ima_open_htable_violations,
.read = ima_show_htable_violations,
.llseek = generic_file_llseek,
};
@@ -76,7 +89,6 @@ static ssize_t ima_show_measurements_count(struct file *filp,
struct ima_namespace *ima_ns = get_current_ns();

return ima_show_htable_value(buf, count, ppos, &ima_ns->ml_len);
-
}

static const struct file_operations ima_measurements_count_ops = {
@@ -552,7 +564,7 @@ int __init ima_fs_init(void)
goto out;

violations =
- securityfs_create_file("violations", S_IRUSR | S_IRGRP,
+ securityfs_create_file("violations", S_IRUSR | S_IRGRP | S_IROTH,
ima_dir, NULL, &ima_htable_violations_ops);
if (IS_ERR(violations))
goto out;
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index ac9509d8c0f0..f7b25b3f95de 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c
@@ -37,6 +37,7 @@ struct ima_namespace init_ima_ns = {
.iint_tree = &init_iint_tree,
.measurements = &ima_measurements,
.ml_len = ATOMIC_LONG_INIT(0),
+ .violations = ATOMIC_LONG_INIT(0),
};
EXPORT_SYMBOL(init_ima_ns);

diff --git a/security/integrity/ima/ima_ns.c b/security/integrity/ima/ima_ns.c
index 81de492baa99..3012287b22d2 100644
--- a/security/integrity/ima/ima_ns.c
+++ b/security/integrity/ima/ima_ns.c
@@ -127,6 +127,7 @@ static struct ima_namespace *clone_ima_ns(struct user_namespace *user_ns,
ns->ucounts = ucounts;
ns->frozen = false;
atomic_long_set(&ns->ml_len, 0);
+ atomic_long_set(&ns->violations, 0);

rwlock_init(&ns->iint_tree->lock);
ns->iint_tree->root = RB_ROOT;
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index ec5b3ca3ef92..912e6097af5b 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -34,7 +34,6 @@ static unsigned long binary_runtime_size = ULONG_MAX;
/* key: inode (before secure-hashing a file) */
struct ima_h_table ima_htable = {
.len = ATOMIC_LONG_INIT(0),
- .violations = ATOMIC_LONG_INIT(0),
.queue[0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT
};

--
2.20.1
\
 
 \ /
  Last update: 2020-08-18 17:59    [W:1.144 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site