Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6c21a7fb authored by Mimi Zohar's avatar Mimi Zohar Committed by James Morris
Browse files

LSM: imbed ima calls in the security hooks 



Based on discussions on LKML and LSM, where there are consecutive
security_ and ima_ calls in the vfs layer, move the ima_ calls to
the existing security_ hooks.

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 6e8e16c7

fs/exec.c

+0 −4
Original line number Original line Diff line number Diff line
@@ -46,7 +46,6 @@ 
#include <linux/proc_fs.h>

#include <linux/proc_fs.h>

#include <linux/mount.h>

#include <linux/mount.h>

#include <linux/security.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/syscalls.h>

#include <linux/syscalls.h>

#include <linux/tsacct_kern.h>

#include <linux/tsacct_kern.h>

#include <linux/cn_proc.h>

#include <linux/cn_proc.h>
@@ -1209,9 +1208,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) 
	struct linux_binfmt *fmt;

	struct linux_binfmt *fmt;





	retval = security_bprm_check(bprm);

	retval = security_bprm_check(bprm);

	if (retval)

		return retval;

	retval = ima_bprm_check(bprm);

	if (retval)

	if (retval)

		return retval;

		return retval;

fs/file_table.c

+0 −2
Original line number Original line Diff line number Diff line
@@ -13,7 +13,6 @@ 
#include <linux/module.h>

#include <linux/module.h>

#include <linux/fs.h>

#include <linux/fs.h>

#include <linux/security.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/eventpoll.h>

#include <linux/eventpoll.h>

#include <linux/rcupdate.h>

#include <linux/rcupdate.h>

#include <linux/mount.h>

#include <linux/mount.h>
@@ -280,7 +279,6 @@ void __fput(struct file *file) 
	if (file->f_op && file->f_op->release)

	if (file->f_op && file->f_op->release)

		file->f_op->release(inode, file);

		file->f_op->release(inode, file);

	security_file_free(file);

	security_file_free(file);

	ima_file_free(file);

	if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))

	if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))

		cdev_put(inode->i_cdev);

		cdev_put(inode->i_cdev);

	fops_put(file->f_op);

	fops_put(file->f_op);

fs/inode.c

+0 −10
Original line number Original line Diff line number Diff line
@@ -18,7 +18,6 @@ 
#include <linux/hash.h>

#include <linux/hash.h>

#include <linux/swap.h>

#include <linux/swap.h>

#include <linux/security.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/pagemap.h>

#include <linux/pagemap.h>

#include <linux/cdev.h>

#include <linux/cdev.h>

#include <linux/bootmem.h>

#include <linux/bootmem.h>
@@ -157,11 +156,6 @@ int inode_init_always(struct super_block *sb, struct inode *inode) 




	if (security_inode_alloc(inode))

	if (security_inode_alloc(inode))

		goto out;

		goto out;



	/* allocate and initialize an i_integrity */

	if (ima_inode_alloc(inode))

		goto out_free_security;



	spin_lock_init(&inode->i_lock);

	spin_lock_init(&inode->i_lock);

	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);

	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
@@ -201,9 +195,6 @@ int inode_init_always(struct super_block *sb, struct inode *inode) 
#endif

#endif





	return 0;

	return 0;



out_free_security:

	security_inode_free(inode);

out:

out:

	return -ENOMEM;

	return -ENOMEM;

}

}
@@ -235,7 +226,6 @@ static struct inode *alloc_inode(struct super_block *sb) 
void __destroy_inode(struct inode *inode)

void __destroy_inode(struct inode *inode)

{

{

	BUG_ON(inode_has_buffers(inode));

	BUG_ON(inode_has_buffers(inode));

	ima_inode_free(inode);

	security_inode_free(inode);

	security_inode_free(inode);

	fsnotify_inode_delete(inode);

	fsnotify_inode_delete(inode);

#ifdef CONFIG_FS_POSIX_ACL

#ifdef CONFIG_FS_POSIX_ACL

mm/mmap.c

+0 −4
Original line number Original line Diff line number Diff line
@@ -20,7 +20,6 @@ 
#include <linux/fs.h>

#include <linux/fs.h>

#include <linux/personality.h>

#include <linux/personality.h>

#include <linux/security.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/hugetlb.h>

#include <linux/hugetlb.h>

#include <linux/profile.h>

#include <linux/profile.h>

#include <linux/module.h>

#include <linux/module.h>
@@ -1059,9 +1058,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, 
	}

	}





	error = security_file_mmap(file, reqprot, prot, flags, addr, 0);

	error = security_file_mmap(file, reqprot, prot, flags, addr, 0);

	if (error)

		return error;

	error = ima_file_mmap(file, prot);

	if (error)

	if (error)

		return error;

		return error;

security/integrity/ima/Kconfig

+1 −0
Original line number Original line Diff line number Diff line
@@ -3,6 +3,7 @@ 
config IMA

config IMA

	bool "Integrity Measurement Architecture(IMA)"

	bool "Integrity Measurement Architecture(IMA)"

	depends on ACPI

	depends on ACPI

	depends on SECURITY

	select SECURITYFS

	select SECURITYFS

	select CRYPTO

	select CRYPTO

	select CRYPTO_HMAC

	select CRYPTO_HMAC