Newly created files do not get initial security.ima until close.
Setting xattr value before close fails because EVM fails to verify
integrity due to missing xattrs. Following is the example when it
happens:
fd = open("foo", O_CREAT | O_WRONLY, 0644);
setxattr("foo", "security.SMACK64", value, sizeof(value), 0);
close(fd);
This patch skips integrity verification if IMA_NEW_FILE flag is set.
Signed-off-by: Dmitry Kasatkin <d.kasatkin@xxxxxxxxxxx>
---
security/integrity/evm/evm_main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 3bcb80d..682e640 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -248,10 +248,14 @@ EXPORT_SYMBOL_GPL(evm_verifyxattr);
static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
+ struct integrity_iint_cache *iint;
if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode)
return 0;
- return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
+ iint = integrity_iint_find(inode);
+ if (iint && (iint->flags & IMA_NEW_FILE))
+ return 0;
+ return evm_verify_hmac(dentry, NULL, NULL, 0, iint);
}
/*
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
