Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 904de138 authored by Roberto Sassu's avatar Roberto Sassu Committed by Greg Kroah-Hartman
Browse files

ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() 



[ Upstream commit 0014cc04e8ec077dc482f00c87dfd949cfe2b98f ]

Commit a408e4a86b36 ("ima: open a new file instance if no read
permissions") tries to create a new file descriptor to calculate a file
digest if the file has not been opened with O_RDONLY flag. However, if a
new file descriptor cannot be obtained, it sets the FMODE_READ flag to
file->f_flags instead of file->f_mode.

This patch fixes this issue by replacing f_flags with f_mode as it was
before that commit.

Cc: stable@vger.kernel.org # 4.20.x
Fixes: a408e4a86b36 ("ima: open a new file instance if no read permissions")
Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: default avatarGoldwyn Rodrigues <rgoldwyn@suse.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 512f9837

security/integrity/ima/ima_crypto.c

+6 −6
Original line number Diff line number Diff line
@@ -415,7 +415,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) 
	loff_t i_size;

	int rc;

	struct file *f = file;

	bool new_file_instance = false, modified_flags = false;

	bool new_file_instance = false, modified_mode = false;



	/*

	 * For consistency, fail file's opened with the O_DIRECT flag on
@@ -435,13 +435,13 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) 
		f = dentry_open(&file->f_path, flags, file->f_cred);

		if (IS_ERR(f)) {

			/*

			 * Cannot open the file again, lets modify f_flags

			 * Cannot open the file again, lets modify f_mode

			 * of original and continue

			 */

			pr_info_ratelimited("Unable to reopen file for reading.\n");

			f = file;

			f->f_flags |= FMODE_READ;

			modified_flags = true;

			f->f_mode |= FMODE_READ;

			modified_mode = true;

		} else {

			new_file_instance = true;

		}
@@ -459,8 +459,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) 
out:

	if (new_file_instance)

		fput(f);

	else if (modified_flags)

		f->f_flags &= ~FMODE_READ;

	else if (modified_mode)

		f->f_mode &= ~FMODE_READ;

	return rc;

}