Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1adace9b authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: remove unnecessary call to ima_must_measure 



The original ima_must_measure() function based its results on cached
iint information, which required an iint be allocated for all files.
Currently, an iint is allocated only for files in policy.  As a result,
for those files in policy, ima_must_measure() is now called twice: once
to determine if the inode is in the measurement policy and, the second
time, to determine if it needs to be measured/re-measured.

The second call to ima_must_measure() unnecessarily checks to see if
the file is in policy. As we already know the file is in policy, this
patch removes the second unnecessary call to ima_must_measure(), removes
the vestige iint parameter, and just checks the iint directly to determine
if the inode has been measured or needs to be measured/re-measured.

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Acked-by: default avatarEric Paris <eparis@redhat.com>
parent 854fdd55

security/integrity/ima/ima.h

+1 −2
Original line number Diff line number Diff line
@@ -110,8 +110,7 @@ struct ima_iint_cache { 
};



/* LIM API function definitions */

int ima_must_measure(struct ima_iint_cache *iint, struct inode *inode,

		     int mask, int function);

int ima_must_measure(struct inode *inode, int mask, int function);

int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file);

void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,

			   const unsigned char *filename);

security/integrity/ima/ima_api.c

+3 −10
Original line number Diff line number Diff line
@@ -105,20 +105,13 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename, 
 * 	mask: contains the permission mask

 *	fsmagic: hex value

 *

 * Must be called with iint->mutex held.

 *

 * Return 0 to measure. Return 1 if already measured.

 * For matching a DONT_MEASURE policy, no policy, or other

 * error, return an error code.

 * Return 0 to measure. For matching a DONT_MEASURE policy, no policy,

 * or other error, return an error code.

*/

int ima_must_measure(struct ima_iint_cache *iint, struct inode *inode,

		     int mask, int function)

int ima_must_measure(struct inode *inode, int mask, int function)

{

	int must_measure;



	if (iint && iint->flags & IMA_MEASURED)

		return 1;



	must_measure = ima_match_policy(inode, function, mask);

	return must_measure ? 0 : -EACCES;

}

security/integrity/ima/ima_main.c

+3 −3
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ static void ima_rdwr_violation_check(struct file *file) 
		goto out;

	}



	rc = ima_must_measure(NULL, inode, MAY_READ, FILE_CHECK);

	rc = ima_must_measure(inode, MAY_READ, FILE_CHECK);

	if (rc < 0)

		goto out;
@@ -127,7 +127,7 @@ static int process_measurement(struct file *file, const unsigned char *filename, 
	if (!ima_initialized || !S_ISREG(inode->i_mode))

		return 0;



	rc = ima_must_measure(NULL, inode, mask, function);

	rc = ima_must_measure(inode, mask, function);

	if (rc != 0)

		return rc;

retry:
@@ -141,7 +141,7 @@ static int process_measurement(struct file *file, const unsigned char *filename, 


	mutex_lock(&iint->mutex);



	rc = ima_must_measure(iint, inode, mask, function);

	rc = iint->flags & IMA_MEASURED ? 1 : 0;

	if (rc != 0)

		goto out;