Commit b151d6b0 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar

ima: provide flag to identify new empty files

On ima_file_free(), newly created empty files are not labeled with
an initial security.ima value, because the iversion did not change.
Commit dff6efc3 "fs: fix iversion handling" introduced a change in
iversion behavior.  To verify this change use the shell command:

  $ (exec >foo)
  $ getfattr -h -e hex -d -m security foo

This patch defines the IMA_NEW_FILE flag.  The flag is initially
set, when IMA detects that a new file is created, and subsequently
checked on the ima_file_free() hook to set the initial security.ima
value.
Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org>  3.14+
parent 1f100979
...@@ -202,8 +202,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, ...@@ -202,8 +202,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
goto out; goto out;
cause = "missing-hash"; cause = "missing-hash";
status = status = INTEGRITY_NOLABEL;
(inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL; if (inode->i_size == 0) {
iint->flags |= IMA_NEW_FILE;
status = INTEGRITY_PASS;
}
goto out; goto out;
} }
......
...@@ -124,12 +124,14 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint, ...@@ -124,12 +124,14 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
return; return;
mutex_lock(&inode->i_mutex); mutex_lock(&inode->i_mutex);
if (atomic_read(&inode->i_writecount) == 1 && if (atomic_read(&inode->i_writecount) == 1) {
iint->version != inode->i_version) { if ((iint->version != inode->i_version) ||
iint->flags &= ~IMA_DONE_MASK; (iint->flags & IMA_NEW_FILE)) {
iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
if (iint->flags & IMA_APPRAISE) if (iint->flags & IMA_APPRAISE)
ima_update_xattr(iint, file); ima_update_xattr(iint, file);
} }
}
mutex_unlock(&inode->i_mutex); mutex_unlock(&inode->i_mutex);
} }
......
...@@ -31,6 +31,7 @@ ...@@ -31,6 +31,7 @@
#define IMA_DIGSIG 0x01000000 #define IMA_DIGSIG 0x01000000
#define IMA_DIGSIG_REQUIRED 0x02000000 #define IMA_DIGSIG_REQUIRED 0x02000000
#define IMA_PERMIT_DIRECTIO 0x04000000 #define IMA_PERMIT_DIRECTIO 0x04000000
#define IMA_NEW_FILE 0x08000000
#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
IMA_APPRAISE_SUBMASK) IMA_APPRAISE_SUBMASK)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment