Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f5e51fa3 authored by Thiago Jung Bauermann's avatar Thiago Jung Bauermann Committed by Mimi Zohar
Browse files

ima: Improvements in ima_appraise_measurement() 



Replace nested ifs in the EVM xattr verification logic with a switch
statement, making the code easier to understand.

Also, add comments to the if statements in the out section and constify the
cause variable.

Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: default avatarThiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
parent 1775cb87

security/integrity/ima/ima_appraise.c

+22 −13
Original line number Original line Diff line number Diff line
@@ -215,7 +215,7 @@ int ima_appraise_measurement(enum ima_hooks func, 
			     int xattr_len, int opened)

			     int xattr_len, int opened)

{

{

	static const char op[] = "appraise_data";

	static const char op[] = "appraise_data";

	char *cause = "unknown";

	const char *cause = "unknown";

	struct dentry *dentry = file_dentry(file);

	struct dentry *dentry = file_dentry(file);

	struct inode *inode = d_backing_inode(dentry);

	struct inode *inode = d_backing_inode(dentry);

	enum integrity_status status = INTEGRITY_UNKNOWN;

	enum integrity_status status = INTEGRITY_UNKNOWN;
@@ -241,16 +241,22 @@ int ima_appraise_measurement(enum ima_hooks func, 
	}

	}





	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);

	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);

	if ((status != INTEGRITY_PASS) &&

	switch (status) {

	    (status != INTEGRITY_PASS_IMMUTABLE) &&

	case INTEGRITY_PASS:

	    (status != INTEGRITY_UNKNOWN)) {

	case INTEGRITY_PASS_IMMUTABLE:

		if ((status == INTEGRITY_NOLABEL)

	case INTEGRITY_UNKNOWN:

		    || (status == INTEGRITY_NOXATTRS))

		break;

	case INTEGRITY_NOXATTRS:	/* No EVM protected xattrs. */

	case INTEGRITY_NOLABEL:		/* No security.evm xattr. */

		cause = "missing-HMAC";

		cause = "missing-HMAC";

		else if (status == INTEGRITY_FAIL)

		goto out;

	case INTEGRITY_FAIL:		/* Invalid HMAC/signature. */

		cause = "invalid-HMAC";

		cause = "invalid-HMAC";

		goto out;

		goto out;

	default:

		WARN_ONCE(true, "Unexpected integrity status %d\n", status);

	}

	}



	switch (xattr_value->type) {

	switch (xattr_value->type) {

	case IMA_XATTR_DIGEST_NG:

	case IMA_XATTR_DIGEST_NG:

		/* first byte contains algorithm id */

		/* first byte contains algorithm id */
@@ -316,17 +322,20 @@ int ima_appraise_measurement(enum ima_hooks func, 
		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,

		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,

				    op, cause, rc, 0);

				    op, cause, rc, 0);

	} else if (status != INTEGRITY_PASS) {

	} else if (status != INTEGRITY_PASS) {

		/* Fix mode, but don't replace file signatures. */

		if ((ima_appraise & IMA_APPRAISE_FIX) &&

		if ((ima_appraise & IMA_APPRAISE_FIX) &&

		    (!xattr_value ||

		    (!xattr_value ||

		     xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {

		     xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {

			if (!ima_fix_xattr(dentry, iint))

			if (!ima_fix_xattr(dentry, iint))

				status = INTEGRITY_PASS;

				status = INTEGRITY_PASS;

		} else if ((inode->i_size == 0) &&

		}

			   (iint->flags & IMA_NEW_FILE) &&



			   (xattr_value &&

		/* Permit new files with file signatures, but without data. */

			    xattr_value->type == EVM_IMA_XATTR_DIGSIG)) {

		if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE &&

		    xattr_value && xattr_value->type == EVM_IMA_XATTR_DIGSIG) {

			status = INTEGRITY_PASS;

			status = INTEGRITY_PASS;

		}

		}



		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,

		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,

				    op, cause, rc, 0);

				    op, cause, rc, 0);

	} else {

	} else {