Commit 4e8581ee authored Nov 30, 2017 by Roberto Sassu Committed by Mimi Zohar Dec 18, 2017

ima: pass filename to ima_rdwr_violation_check()



ima_rdwr_violation_check() retrieves the full path of a measured file by
calling ima_d_path(). If process_measurement() calls this function, it
reuses the pointer and passes it to the functions to measure/appraise/audit
an accessed file.

After commit bc15ed66 ("ima: fix ima_d_path() possible race with
rename"), ima_d_path() first tries to retrieve the full path by calling
d_absolute_path() and, if there is an error, copies the dentry name to the
buffer passed as argument.

However, ima_rdwr_violation_check() passes to ima_d_path() the pointer of a
local variable. process_measurement() might be reusing the pointer to an
area in the stack which may have been already overwritten after
ima_rdwr_violation_check() returned.

Correct this issue by passing to ima_rdwr_violation_check() the pointer of
a buffer declared in process_measurement().

Fixes: bc15ed66 ("ima: fix ima_d_path() possible race with rename")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

parent 72bf83b0

security/integrity/ima/ima_main.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -84,10 +84,10 @@ static void ima_rdwr_violation_check(struct file *file,
		struct integrity_iint_cache *iint,
		int must_measure,
		char **pathbuf,
		const char **pathname)
		const char **pathname,
		char *filename)
		{
		struct inode *inode = file_inode(file);
		char filename[NAME_MAX];
		fmode_t mode = file->f_mode;
		bool send_tomtou = false, send_writers = false;

		@@ -210,7 +210,7 @@ static int process_measurement(struct file file, char buf, loff_t size,

		if (!rc && violation_check)
		ima_rdwr_violation_check(file, iint, action & IMA_MEASURE,
		&pathbuf, &pathname);
		&pathbuf, &pathname, filename);

		inode_unlock(inode);