On Fri, 2014-07-11 at 14:46 +0300, Dmitry Kasatkin wrote:
> Newly created empty files do not get initial security.ima
> value because iversion does not change. It can be checked from
> the shell as:
>
> $ (exec >foo)
> $ getfattr -h -e hex -d -m security foo
>
> This patch defines IMA_NEW_FILE flag which is set when IMA detects that new
> file is created. It is checked upon ima_file_free hook to set initial
> security.ima value.
Other than rebasing on top of #next, this patch set looks good.
thanks,
Mimi
> Signed-off-by: Dmitry Kasatkin <d.kasatkin@xxxxxxxxxxx>
> ---
> security/integrity/ima/ima_appraise.c | 7 +++++--
> security/integrity/ima/ima_main.c | 12 +++++++-----
> security/integrity/integrity.h | 1 +
> 3 files changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
> index 9dd18b5..3a4beb3 100644
> --- a/security/integrity/ima/ima_appraise.c
> +++ b/security/integrity/ima/ima_appraise.c
> @@ -194,8 +194,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
> goto out;
>
> cause = "missing-hash";
> - status =
> - (inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL;
> + status = INTEGRITY_NOLABEL;
> + if (inode->i_size == 0) {
> + iint->flags |= IMA_NEW_FILE;
> + status = INTEGRITY_PASS;
> + }
> goto out;
> }
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index e51e0d5..5a870e7 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -124,11 +124,13 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
> return;
>
> mutex_lock(&iint->mutex);
> - if (atomic_read(&inode->i_writecount) == 1 &&
> - iint->version != inode->i_version) {
> - iint->flags &= ~IMA_DONE_MASK;
> - if (iint->flags & IMA_APPRAISE)
> - ima_update_xattr(iint, file);
> + if (atomic_read(&inode->i_writecount) == 1) {
> + if ((iint->version != inode->i_version) ||
> + (iint->flags & IMA_NEW_FILE)) {
> + iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
> + if (iint->flags & IMA_APPRAISE)
> + ima_update_xattr(iint, file);
> + }
> }
> mutex_unlock(&iint->mutex);
> }
> diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
> index 92c1083..7656d47 100644
> --- a/security/integrity/integrity.h
> +++ b/security/integrity/integrity.h
> @@ -30,6 +30,7 @@
> #define IMA_ACTION_FLAGS 0xff000000
> #define IMA_DIGSIG_REQUIRED 0x01000000
> #define IMA_PERMIT_DIRECTIO 0x02000000
> +#define IMA_NEW_FILE 0x04000000
>
> #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
> IMA_APPRAISE_SUBMASK)
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
