Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b151d6b0 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar
Browse files

ima: provide flag to identify new empty files 



On ima_file_free(), newly created empty files are not labeled with
an initial security.ima value, because the iversion did not change.
Commit dff6efc3 "fs: fix iversion handling" introduced a change in
iversion behavior.  To verify this change use the shell command:

  $ (exec >foo)
  $ getfattr -h -e hex -d -m security foo

This patch defines the IMA_NEW_FILE flag.  The flag is initially
set, when IMA detects that a new file is created, and subsequently
checked on the ima_file_free() hook to set the initial security.ima
value.

Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org>  3.14+
parent 1f100979

security/integrity/ima/ima_appraise.c

+5 −2
Original line number Diff line number Diff line
@@ -202,8 +202,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, 
			goto out;



		cause = "missing-hash";

		status =

		    (inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL;

		status = INTEGRITY_NOLABEL;

		if (inode->i_size == 0) {

			iint->flags |= IMA_NEW_FILE;

			status = INTEGRITY_PASS;

		}

		goto out;

	}

security/integrity/ima/ima_main.c

+7 −5
Original line number Diff line number Diff line
@@ -124,12 +124,14 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint, 
		return;



	mutex_lock(&inode->i_mutex);

	if (atomic_read(&inode->i_writecount) == 1 &&

	    iint->version != inode->i_version) {

		iint->flags &= ~IMA_DONE_MASK;

	if (atomic_read(&inode->i_writecount) == 1) {

		if ((iint->version != inode->i_version) ||

		    (iint->flags & IMA_NEW_FILE)) {

			iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);

			if (iint->flags & IMA_APPRAISE)

				ima_update_xattr(iint, file);

		}

	}

	mutex_unlock(&inode->i_mutex);

}

security/integrity/integrity.h

+1 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ 
#define IMA_DIGSIG		0x01000000

#define IMA_DIGSIG_REQUIRED	0x02000000

#define IMA_PERMIT_DIRECTIO	0x04000000

#define IMA_NEW_FILE		0x08000000



#define IMA_DO_MASK		(IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \

				 IMA_APPRAISE_SUBMASK)