Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f6723e2 authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: define is_ima_appraise_enabled() 



Only return enabled if in enforcing mode, not fix or log modes.

Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>

Changes:
- Define is_ima_appraise_enabled() as a bool (Thiago Bauermann)
parent e1f5e01f

include/linux/ima.h

+6 −0
Original line number Diff line number Diff line
@@ -75,11 +75,17 @@ static inline void ima_add_kexec_buffer(struct kimage *image) 
#endif



#ifdef CONFIG_IMA_APPRAISE

extern bool is_ima_appraise_enabled(void);

extern void ima_inode_post_setattr(struct dentry *dentry);

extern int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,

		       const void *xattr_value, size_t xattr_value_len);

extern int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name);

#else

static inline bool is_ima_appraise_enabled(void)

{

	return 0;

}



static inline void ima_inode_post_setattr(struct dentry *dentry)

{

	return;

security/integrity/ima/ima_appraise.c

+10 −0
Original line number Diff line number Diff line
@@ -33,6 +33,16 @@ static int __init default_appraise_setup(char *str) 


__setup("ima_appraise=", default_appraise_setup);



/*

 * is_ima_appraise_enabled - return appraise status

 *

 * Only return enabled, if not in ima_appraise="fix" or "log" modes.

 */

bool is_ima_appraise_enabled(void)

{

	return (ima_appraise & IMA_APPRAISE_ENFORCE) ? 1 : 0;

}



/*

 * ima_must_appraise - set appraise flag

 *