On 12:28 27/04, Roberto Sassu wrote:
> Commit a408e4a86b36 ("ima: open a new file instance if no read
> permissions") tries to create a new file descriptor to calculate a file
> digest if the file has not been opened with O_RDONLY flag. However, if a
> new file descriptor cannot be obtained, it sets the FMODE_READ flag to
> file->f_flags instead of file->f_mode.
>
> This patch fixes this issue by replacing f_flags with f_mode as it was
> before that commit.
Thanks for fixing this.
Reviewed-by: Goldwyn Rodrigues <rgoldwyn@xxxxxxxx>
>
> Changelog
>
> v1:
> - fix comment for f_mode change (suggested by Mimi)
> - rename modified_flags variable to modified_mode (suggested by Mimi)
>
> Cc: stable@xxxxxxxxxxxxxxx # 4.20.x
> Fixes: a408e4a86b36 ("ima: open a new file instance if no read permissions")
> Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
> ---
> security/integrity/ima/ima_crypto.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
> index 5201f5ec2ce4..f3a7f4eb1fc1 100644
> --- a/security/integrity/ima/ima_crypto.c
> +++ b/security/integrity/ima/ima_crypto.c
> @@ -537,7 +537,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
> loff_t i_size;
> int rc;
> struct file *f = file;
> - bool new_file_instance = false, modified_flags = false;
> + bool new_file_instance = false, modified_mode = false;
>
> /*
> * For consistency, fail file's opened with the O_DIRECT flag on
> @@ -557,13 +557,13 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
> f = dentry_open(&file->f_path, flags, file->f_cred);
> if (IS_ERR(f)) {
> /*
> - * Cannot open the file again, lets modify f_flags
> + * Cannot open the file again, lets modify f_mode
> * of original and continue
> */
> pr_info_ratelimited("Unable to reopen file for reading.\n");
> f = file;
> - f->f_flags |= FMODE_READ;
> - modified_flags = true;
> + f->f_mode |= FMODE_READ;
> + modified_mode = true;
> } else {
> new_file_instance = true;
> }
> @@ -581,8 +581,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
> out:
> if (new_file_instance)
> fput(f);
> - else if (modified_flags)
> - f->f_flags &= ~FMODE_READ;
> + else if (modified_mode)
> + f->f_mode &= ~FMODE_READ;
> return rc;
> }
>
> --
> 2.17.1
>
--
Goldwyn
