Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f85b87a9 authored by Roberto Sassu's avatar Roberto Sassu Committed by Greg Kroah-Hartman
Browse files

ima: show rules with IMA_INMASK correctly 



commit 8cdc23a3d9ec0944000ad43bad588e36afdc38cd upstream.

Show the '^' character when a policy rule has flag IMA_INMASK.

Fixes: 80eae209 ("IMA: allow reading back the current IMA policy")
Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 21158982

security/integrity/ima/ima_policy.c

+12 −9
Original line number Diff line number Diff line
@@ -1059,10 +1059,10 @@ enum { 
};



static const char *const mask_tokens[] = {

	"MAY_EXEC",

	"MAY_WRITE",

	"MAY_READ",

	"MAY_APPEND"

	"^MAY_EXEC",

	"^MAY_WRITE",

	"^MAY_READ",

	"^MAY_APPEND"

};



#define __ima_hook_stringify(str)	(#str),
@@ -1122,6 +1122,7 @@ int ima_policy_show(struct seq_file *m, void *v) 
	struct ima_rule_entry *entry = v;

	int i;

	char tbuf[64] = {0,};

	int offset = 0;



	rcu_read_lock();
@@ -1145,15 +1146,17 @@ int ima_policy_show(struct seq_file *m, void *v) 
	if (entry->flags & IMA_FUNC)

		policy_func_show(m, entry->func);



	if (entry->flags & IMA_MASK) {

	if ((entry->flags & IMA_MASK) || (entry->flags & IMA_INMASK)) {

		if (entry->flags & IMA_MASK)

			offset = 1;

		if (entry->mask & MAY_EXEC)

			seq_printf(m, pt(Opt_mask), mt(mask_exec));

			seq_printf(m, pt(Opt_mask), mt(mask_exec) + offset);

		if (entry->mask & MAY_WRITE)

			seq_printf(m, pt(Opt_mask), mt(mask_write));

			seq_printf(m, pt(Opt_mask), mt(mask_write) + offset);

		if (entry->mask & MAY_READ)

			seq_printf(m, pt(Opt_mask), mt(mask_read));

			seq_printf(m, pt(Opt_mask), mt(mask_read) + offset);

		if (entry->mask & MAY_APPEND)

			seq_printf(m, pt(Opt_mask), mt(mask_append));

			seq_printf(m, pt(Opt_mask), mt(mask_append) + offset);

		seq_puts(m, " ");

	}