Re: [PATCH] ima: Reflect correct permissions for policy

[Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx>]

On Fri, 2018-04-20 at 15:28 +0200, Petr Vorel wrote:
> Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n
> keeps 0600 mode after loading policy. Remove write permission to state
> that policy file no longer be written.
> 
> Signed-off-by: Petr Vorel <pvorel@xxxxxxx>

Queued in the next-integrity branch.

thanks,

Mimi
> ---
>  security/integrity/ima/ima_fs.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> index fa540c0469da..c1265127d1b6 100644
> --- a/security/integrity/ima/ima_fs.c
> +++ b/security/integrity/ima/ima_fs.c
> @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file)
>  	ima_policy = NULL;
>  #elif defined(CONFIG_IMA_WRITE_POLICY)
>  	clear_bit(IMA_FS_BUSY, &ima_fs_flags);
> +#elif defined(CONFIG_IMA_READ_POLICY)
> +	inode->i_mode &= ~S_IWUSR;
>  #endif
>  	return 0;
>  }