Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f850a7c0 authored by Eric Paris's avatar Eric Paris Committed by James Morris
Browse files

IMA: remove read permissions on the ima policy file 



The IMA policy file does not implement read.  Trying to just open/read/close
the file will load a blank policy and you cannot then change the policy
without a reboot.  This removes the read permission from the file so one must
at least be attempting to write...

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarMimi Zohar <zohar@us.ibm.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent b1033870

security/integrity/ima/ima_fs.c

+5 −1
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 *	implemenents security file system for reporting

 *	current measurement list and IMA statistics

 */

#include <linux/fcntl.h>

#include <linux/module.h>

#include <linux/seq_file.h>

#include <linux/rculist.h>
@@ -283,6 +284,9 @@ static atomic_t policy_opencount = ATOMIC_INIT(1); 
 */

int ima_open_policy(struct inode * inode, struct file * filp)

{

	/* No point in being allowed to open it if you aren't going to write */

	if (!(filp->f_flags & O_WRONLY))

		return -EACCES;

	if (atomic_dec_and_test(&policy_opencount))

		return 0;

	return -EBUSY;
@@ -349,7 +353,7 @@ int ima_fs_init(void) 
		goto out;



	ima_policy = securityfs_create_file("policy",

					    S_IRUSR | S_IRGRP | S_IWUSR,

					    S_IWUSR,

					    ima_dir, NULL,

					    &ima_measure_policy_ops);

	if (IS_ERR(ima_policy))