Skip to content

Commit 3034a14

Browse files
Dmitry KasatkinMimi Zohar
Dmitry Kasatkin
authored and
Mimi Zohar
committed
ima: pass 'opened' flag to identify newly created files
Empty files and missing xattrs do not guarantee that a file was just created. This patch passes FILE_CREATED flag to IMA to reliably identify new files. Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org> 3.14+
1 parent 3dcbad5 commit 3034a14

File tree

6 files changed

+16
-16
lines changed

6 files changed

+16
-16
lines changed

‎fs/namei.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3058,7 +3058,7 @@ static int do_last(struct nameidata *nd, struct path *path,
30583058
error = open_check_o_direct(file);
30593059
if (error)
30603060
goto exit_fput;
3061-
error = ima_file_check(file, op->acc_mode);
3061+
error = ima_file_check(file, op->acc_mode, *opened);
30623062
if (error)
30633063
goto exit_fput;
30643064

‎fs/nfsd/vfs.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -709,7 +709,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
709709
host_err = PTR_ERR(*filp);
710710
*filp = NULL;
711711
} else {
712-
host_err = ima_file_check(*filp, may_flags);
712+
host_err = ima_file_check(*filp, may_flags, 0);
713713

714714
if (may_flags & NFSD_MAY_64BIT_COOKIE)
715715
(*filp)->f_mode |= FMODE_64BITHASH;

‎include/linux/ima.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ struct linux_binprm;
1515

1616
#ifdef CONFIG_IMA
1717
extern int ima_bprm_check(struct linux_binprm *bprm);
18-
extern int ima_file_check(struct file *file, int mask);
18+
extern int ima_file_check(struct file *file, int mask, int opened);
1919
extern void ima_file_free(struct file *file);
2020
extern int ima_file_mmap(struct file *file, unsigned long prot);
2121
extern int ima_module_check(struct file *file);
@@ -27,7 +27,7 @@ static inline int ima_bprm_check(struct linux_binprm *bprm)
2727
return 0;
2828
}
2929

30-
static inline int ima_file_check(struct file *file, int mask)
30+
static inline int ima_file_check(struct file *file, int mask, int opened)
3131
{
3232
return 0;
3333
}

‎security/integrity/ima/ima.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ void ima_delete_rules(void);
177177
int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
178178
struct file *file, const unsigned char *filename,
179179
struct evm_ima_xattr_data *xattr_value,
180-
int xattr_len);
180+
int xattr_len, int opened);
181181
int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
182182
void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
183183
enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
@@ -193,7 +193,7 @@ static inline int ima_appraise_measurement(int func,
193193
struct file *file,
194194
const unsigned char *filename,
195195
struct evm_ima_xattr_data *xattr_value,
196-
int xattr_len)
196+
int xattr_len, int opened)
197197
{
198198
return INTEGRITY_UNKNOWN;
199199
}

‎security/integrity/ima/ima_appraise.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ int ima_read_xattr(struct dentry *dentry,
183183
int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
184184
struct file *file, const unsigned char *filename,
185185
struct evm_ima_xattr_data *xattr_value,
186-
int xattr_len)
186+
int xattr_len, int opened)
187187
{
188188
static const char op[] = "appraise_data";
189189
char *cause = "unknown";
@@ -203,7 +203,7 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
203203

204204
cause = "missing-hash";
205205
status = INTEGRITY_NOLABEL;
206-
if (inode->i_size == 0) {
206+
if (opened & FILE_CREATED) {
207207
iint->flags |= IMA_NEW_FILE;
208208
status = INTEGRITY_PASS;
209209
}

‎security/integrity/ima/ima_main.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ void ima_file_free(struct file *file)
157157
}
158158

159159
static int process_measurement(struct file *file, const char *filename,
160-
int mask, int function)
160+
int mask, int function, int opened)
161161
{
162162
struct inode *inode = file_inode(file);
163163
struct integrity_iint_cache *iint;
@@ -226,7 +226,7 @@ static int process_measurement(struct file *file, const char *filename,
226226
xattr_value, xattr_len);
227227
if (action & IMA_APPRAISE_SUBMASK)
228228
rc = ima_appraise_measurement(_func, iint, file, pathname,
229-
xattr_value, xattr_len);
229+
xattr_value, xattr_len, opened);
230230
if (action & IMA_AUDIT)
231231
ima_audit_measurement(iint, pathname);
232232
kfree(pathbuf);
@@ -255,7 +255,7 @@ static int process_measurement(struct file *file, const char *filename,
255255
int ima_file_mmap(struct file *file, unsigned long prot)
256256
{
257257
if (file && (prot & PROT_EXEC))
258-
return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK);
258+
return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK, 0);
259259
return 0;
260260
}
261261

@@ -277,7 +277,7 @@ int ima_bprm_check(struct linux_binprm *bprm)
277277
return process_measurement(bprm->file,
278278
(strcmp(bprm->filename, bprm->interp) == 0) ?
279279
bprm->filename : bprm->interp,
280-
MAY_EXEC, BPRM_CHECK);
280+
MAY_EXEC, BPRM_CHECK, 0);
281281
}
282282

283283
/**
@@ -290,12 +290,12 @@ int ima_bprm_check(struct linux_binprm *bprm)
290290
* On success return 0. On integrity appraisal error, assuming the file
291291
* is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
292292
*/
293-
int ima_file_check(struct file *file, int mask)
293+
int ima_file_check(struct file *file, int mask, int opened)
294294
{
295295
ima_rdwr_violation_check(file);
296296
return process_measurement(file, NULL,
297297
mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
298-
FILE_CHECK);
298+
FILE_CHECK, opened);
299299
}
300300
EXPORT_SYMBOL_GPL(ima_file_check);
301301

@@ -318,7 +318,7 @@ int ima_module_check(struct file *file)
318318
#endif
319319
return 0; /* We rely on module signature checking */
320320
}
321-
return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK);
321+
return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK, 0);
322322
}
323323

324324
int ima_fw_from_file(struct file *file, char *buf, size_t size)
@@ -329,7 +329,7 @@ int ima_fw_from_file(struct file *file, char *buf, size_t size)
329329
return -EACCES; /* INTEGRITY_UNKNOWN */
330330
return 0;
331331
}
332-
return process_measurement(file, NULL, MAY_EXEC, FIRMWARE_CHECK);
332+
return process_measurement(file, NULL, MAY_EXEC, FIRMWARE_CHECK, 0);
333333
}
334334

335335
static int __init init_ima(void)

0 commit comments

Comments
 (0)