Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd025f7f authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: do not measure or appraise the NSFS filesystem 



Include don't appraise or measure rules for the NSFS filesystem
in the builtin ima_tcb and ima_appraise_tcb policies.

Changelog:
- Update documentation

Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org # 3.19
parent 6438de9f

Documentation/ABI/testing/ima_policy

+3 −0
Original line number Diff line number Diff line
@@ -65,6 +65,9 @@ Description: 
			# CGROUP_SUPER_MAGIC

			dont_measure fsmagic=0x27e0eb

			dont_appraise fsmagic=0x27e0eb

			# NSFS_MAGIC

			dont_measure fsmagic=0x6e736673

			dont_appraise fsmagic=0x6e736673



			measure func=BPRM_CHECK

			measure func=FILE_MMAP mask=MAY_EXEC

security/integrity/ima/ima_policy.c

+2 −0
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ static struct ima_rule_entry default_rules[] = { 
	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,

	 .flags = IMA_FSMAGIC},

	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},

	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,

	 .flags = IMA_FUNC | IMA_MASK},

	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
@@ -101,6 +102,7 @@ static struct ima_rule_entry default_appraise_rules[] = { 
	{.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},

#ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT

	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},