nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

ima: pass 'opened' flag to identify newly created files

Browse source 
Empty files and missing xattrs do not guarantee that a file was
just created.  This patch passes FILE_CREATED flag to IMA to
reliably identify new files.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org>  3.14+
This commit is contained in:
Dmitry Kasatkin 2014-06-27 18:15:44 +03:00 committed by Mimi Zohar
parent 3dcbad52cf
commit 3034a14682
6 changed files with 16 additions and 16 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
fs/namei.c
View file

@ -3058,7 +3058,7 @@ static int do_last(struct nameidata *nd, struct path *path,
error = open_check_o_direct(file); error = open_check_o_direct(file);
if (error) if (error)
goto exit_fput; goto exit_fput;
error = ima_file_check(file, op->acc_mode); error = ima_file_check(file, op->acc_mode, *opened);
if (error) if (error)
goto exit_fput; goto exit_fput;

2
fs/nfsd/vfs.c
View file

@ -709,7 +709,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
host_err = PTR_ERR(*filp); host_err = PTR_ERR(*filp);
*filp = NULL; *filp = NULL;
} else { } else {
host_err = ima_file_check(*filp, may_flags); host_err = ima_file_check(*filp, may_flags, 0);
if (may_flags & NFSD_MAY_64BIT_COOKIE) if (may_flags & NFSD_MAY_64BIT_COOKIE)
(*filp)->f_mode |= FMODE_64BITHASH; (*filp)->f_mode |= FMODE_64BITHASH;

4
include/linux/ima.h
View file

@ -15,7 +15,7 @@ struct linux_binprm;
#ifdef CONFIG_IMA #ifdef CONFIG_IMA
extern int ima_bprm_check(struct linux_binprm *bprm); extern int ima_bprm_check(struct linux_binprm *bprm);
extern int ima_file_check(struct file *file, int mask); extern int ima_file_check(struct file *file, int mask, int opened);
extern void ima_file_free(struct file *file); extern void ima_file_free(struct file *file);
extern int ima_file_mmap(struct file *file, unsigned long prot); extern int ima_file_mmap(struct file *file, unsigned long prot);
extern int ima_module_check(struct file *file); extern int ima_module_check(struct file *file);
@ -27,7 +27,7 @@ static inline int ima_bprm_check(struct linux_binprm *bprm)
return 0; return 0;
} }
static inline int ima_file_check(struct file *file, int mask) static inline int ima_file_check(struct file *file, int mask, int opened)
{ {
return 0; return 0;
} }

4
security/integrity/ima/ima.h
View file

@ -177,7 +177,7 @@ void ima_delete_rules(void);
int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
struct file *file, const unsigned char *filename, struct file *file, const unsigned char *filename,
struct evm_ima_xattr_data *xattr_value, struct evm_ima_xattr_data *xattr_value,
int xattr_len); int xattr_len, int opened);
int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func); int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file); void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint, enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
@ -193,7 +193,7 @@ static inline int ima_appraise_measurement(int func,
struct file *file, struct file *file,
const unsigned char *filename, const unsigned char *filename,
struct evm_ima_xattr_data *xattr_value, struct evm_ima_xattr_data *xattr_value,
int xattr_len) int xattr_len, int opened)
{ {
return INTEGRITY_UNKNOWN; return INTEGRITY_UNKNOWN;
} }

4
security/integrity/ima/ima_appraise.c
View file

@ -183,7 +183,7 @@ int ima_read_xattr(struct dentry *dentry,
int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
struct file *file, const unsigned char *filename, struct file *file, const unsigned char *filename,
struct evm_ima_xattr_data *xattr_value, struct evm_ima_xattr_data *xattr_value,
int xattr_len) int xattr_len, int opened)
{ {
static const char op[] = "appraise_data"; static const char op[] = "appraise_data";
char *cause = "unknown"; char *cause = "unknown";
@ -203,7 +203,7 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
cause = "missing-hash"; cause = "missing-hash";
status = INTEGRITY_NOLABEL; status = INTEGRITY_NOLABEL;
if (inode->i_size == 0) { if (opened & FILE_CREATED) {
iint->flags |= IMA_NEW_FILE; iint->flags |= IMA_NEW_FILE;
status = INTEGRITY_PASS; status = INTEGRITY_PASS;
} }

16
security/integrity/ima/ima_main.c
View file

@ -157,7 +157,7 @@ void ima_file_free(struct file *file)
} }
static int process_measurement(struct file *file, const char *filename, static int process_measurement(struct file *file, const char *filename,
int mask, int function) int mask, int function, int opened)
{ {
struct inode *inode = file_inode(file); struct inode *inode = file_inode(file);
struct integrity_iint_cache *iint; struct integrity_iint_cache *iint;
@ -226,7 +226,7 @@ static int process_measurement(struct file *file, const char *filename,
xattr_value, xattr_len); xattr_value, xattr_len);
if (action & IMA_APPRAISE_SUBMASK) if (action & IMA_APPRAISE_SUBMASK)
rc = ima_appraise_measurement(_func, iint, file, pathname, rc = ima_appraise_measurement(_func, iint, file, pathname,
xattr_value, xattr_len); xattr_value, xattr_len, opened);
if (action & IMA_AUDIT) if (action & IMA_AUDIT)
ima_audit_measurement(iint, pathname); ima_audit_measurement(iint, pathname);
kfree(pathbuf); kfree(pathbuf);
@ -255,7 +255,7 @@ static int process_measurement(struct file *file, const char *filename,
int ima_file_mmap(struct file *file, unsigned long prot) int ima_file_mmap(struct file *file, unsigned long prot)
{ {
if (file && (prot & PROT_EXEC)) if (file && (prot & PROT_EXEC))
return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK); return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK, 0);
return 0; return 0;
} }
@ -277,7 +277,7 @@ int ima_bprm_check(struct linux_binprm *bprm)
return process_measurement(bprm->file, return process_measurement(bprm->file,
(strcmp(bprm->filename, bprm->interp) == 0) ? (strcmp(bprm->filename, bprm->interp) == 0) ?
bprm->filename : bprm->interp, bprm->filename : bprm->interp,
MAY_EXEC, BPRM_CHECK); MAY_EXEC, BPRM_CHECK, 0);
} }
/** /**
@ -290,12 +290,12 @@ int ima_bprm_check(struct linux_binprm *bprm)
* On success return 0. On integrity appraisal error, assuming the file * On success return 0. On integrity appraisal error, assuming the file
* is in policy and IMA-appraisal is in enforcing mode, return -EACCES. * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
*/ */
int ima_file_check(struct file *file, int mask) int ima_file_check(struct file *file, int mask, int opened)
{ {
ima_rdwr_violation_check(file); ima_rdwr_violation_check(file);
return process_measurement(file, NULL, return process_measurement(file, NULL,
mask & (MAY_READ | MAY_WRITE | MAY_EXEC), mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
FILE_CHECK); FILE_CHECK, opened);
} }
EXPORT_SYMBOL_GPL(ima_file_check); EXPORT_SYMBOL_GPL(ima_file_check);
@ -318,7 +318,7 @@ int ima_module_check(struct file *file)
#endif #endif
return 0; /* We rely on module signature checking */ return 0; /* We rely on module signature checking */
} }
return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK); return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK, 0);
} }
int ima_fw_from_file(struct file *file, char *buf, size_t size) int ima_fw_from_file(struct file *file, char *buf, size_t size)
@ -329,7 +329,7 @@ int ima_fw_from_file(struct file *file, char *buf, size_t size)
return -EACCES; /* INTEGRITY_UNKNOWN */ return -EACCES; /* INTEGRITY_UNKNOWN */
return 0; return 0;
} }
return process_measurement(file, NULL, MAY_EXEC, FIRMWARE_CHECK); return process_measurement(file, NULL, MAY_EXEC, FIRMWARE_CHECK, 0);
} }
static int __init init_ima(void) static int __init init_ima(void)