Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4351c294 authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: extend "mask" policy matching support 



The current "mask" policy option matches files opened as MAY_READ,
MAY_WRITE, MAY_APPEND or MAY_EXEC.  This patch extends the "mask"
option to match files opened containing one of these modes.  For
example, "mask=^MAY_READ" would match files opened read-write.

Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: default avatarDr. Greg Wettstein <gw@idfusion.org>
Cc: stable@vger.kernel.org
parent 139069ef

Documentation/ABI/testing/ima_policy

+2 −1
Original line number Diff line number Diff line
@@ -27,7 +27,8 @@ Description: 


		base: 	func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]

				[FIRMWARE_CHECK]

			mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]

			mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]

			       [[^]MAY_EXEC]

			fsmagic:= hex value

			fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)

			uid:= decimal value

security/integrity/ima/ima_policy.c

+15 −5
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#define IMA_UID		0x0008

#define IMA_FOWNER	0x0010

#define IMA_FSUUID	0x0020

#define IMA_INMASK	0x0040

#define IMA_EUID	0x0080



#define UNKNOWN		0
@@ -187,6 +188,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule, 
	if ((rule->flags & IMA_MASK) &&

	    (rule->mask != mask && func != POST_SETATTR))

		return false;

	if ((rule->flags & IMA_INMASK) &&

	    (!(rule->mask & mask) && func != POST_SETATTR))

		return false;

	if ((rule->flags & IMA_FSMAGIC)

	    && rule->fsmagic != inode->i_sb->s_magic)

		return false;
@@ -448,6 +452,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value) 
static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)

{

	struct audit_buffer *ab;

	char *from;

	char *p;

	int result = 0;
@@ -538,18 +543,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 
			if (entry->mask)

				result = -EINVAL;



			if ((strcmp(args[0].from, "MAY_EXEC")) == 0)

			from = args[0].from;

			if (*from == '^')

				from++;



			if ((strcmp(from, "MAY_EXEC")) == 0)

				entry->mask = MAY_EXEC;

			else if (strcmp(args[0].from, "MAY_WRITE") == 0)

			else if (strcmp(from, "MAY_WRITE") == 0)

				entry->mask = MAY_WRITE;

			else if (strcmp(args[0].from, "MAY_READ") == 0)

			else if (strcmp(from, "MAY_READ") == 0)

				entry->mask = MAY_READ;

			else if (strcmp(args[0].from, "MAY_APPEND") == 0)

			else if (strcmp(from, "MAY_APPEND") == 0)

				entry->mask = MAY_APPEND;

			else

				result = -EINVAL;

			if (!result)

				entry->flags |= IMA_MASK;

				entry->flags |= (*args[0].from == '^')

				     ? IMA_INMASK : IMA_MASK;

			break;

		case Opt_fsmagic:

			ima_log_string(ab, "fsmagic", args[0].from);