Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55e2430e authored by Tyler Hicks's avatar Tyler Hicks Committed by Greg Kroah-Hartman
Browse files

ima: Rename internal filter rule functions 



[ Upstream commit b8867eedcf76caef8ae6412da97cd9abfd092ff8 ]

Rename IMA's internal filter rule functions from security_filter_rule_*()
to ima_filter_rule_*(). This avoids polluting the security_* namespace,
which is typically reserved for general security subsystem
infrastructure.

Signed-off-by: default avatarTyler Hicks <tyhicks@linux.microsoft.com>
Suggested-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
[zohar@linux.ibm.com: reword using the term "filter", not "audit"]
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Stable-dep-of: c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 0b7c47b7

security/integrity/ima/ima.h

+8 −8
Original line number Diff line number Diff line
@@ -361,23 +361,23 @@ static inline void ima_free_modsig(struct modsig *modsig) 
/* LSM based policy rules require audit */

#ifdef CONFIG_IMA_LSM_RULES



#define security_filter_rule_init security_audit_rule_init

#define security_filter_rule_free security_audit_rule_free

#define security_filter_rule_match security_audit_rule_match

#define ima_filter_rule_init security_audit_rule_init

#define ima_filter_rule_free security_audit_rule_free

#define ima_filter_rule_match security_audit_rule_match



#else



static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,

static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,

				       void **lsmrule)

{

	return -EINVAL;

}



static inline void security_filter_rule_free(void *lsmrule)

static inline void ima_filter_rule_free(void *lsmrule)

{

}



static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,

static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,

					void *lsmrule)

{

	return -EINVAL;

security/integrity/ima/ima_policy.c

+13 −17
Original line number Diff line number Diff line
@@ -254,7 +254,7 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry) 
	int i;



	for (i = 0; i < MAX_LSM_RULES; i++) {

		security_filter_rule_free(entry->lsm[i].rule);

		ima_filter_rule_free(entry->lsm[i].rule);

		kfree(entry->lsm[i].args_p);

	}

	kfree(entry);
@@ -286,8 +286,7 @@ static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) 
		if (!nentry->lsm[i].args_p)

			goto out_err;



		security_filter_rule_init(nentry->lsm[i].type,

					  Audit_equal,

		ima_filter_rule_init(nentry->lsm[i].type, Audit_equal,

				     nentry->lsm[i].args_p,

				     &nentry->lsm[i].rule);

		if (!nentry->lsm[i].rule)
@@ -425,16 +424,14 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, 
		case LSM_OBJ_ROLE:

		case LSM_OBJ_TYPE:

			security_inode_getsecid(inode, &osid);

			rc = security_filter_rule_match(osid,

							rule->lsm[i].type,

			rc = ima_filter_rule_match(osid, rule->lsm[i].type,

						   Audit_equal,

						   rule->lsm[i].rule);

			break;

		case LSM_SUBJ_USER:

		case LSM_SUBJ_ROLE:

		case LSM_SUBJ_TYPE:

			rc = security_filter_rule_match(secid,

							rule->lsm[i].type,

			rc = ima_filter_rule_match(secid, rule->lsm[i].type,

						   Audit_equal,

						   rule->lsm[i].rule);

		default:
@@ -821,8 +818,7 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry, 
		return -ENOMEM;



	entry->lsm[lsm_rule].type = audit_type;

	result = security_filter_rule_init(entry->lsm[lsm_rule].type,

					   Audit_equal,

	result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal,

				      entry->lsm[lsm_rule].args_p,

				      &entry->lsm[lsm_rule].rule);

	if (!entry->lsm[lsm_rule].rule) {