ima: fix ima_d_path() possible race with rename

Mimi Zohar · Mimi Zohar · commit bc15ed663e7e · 2017-01-27T14:16:02.000-05:00
On failure to return a pathname from ima_d_path(), a pointer to
dname is returned, which is subsequently used in the IMA measurement
list, the IMA audit records, and other audit logging.  Saving the
pointer to dname for later use has the potential to race with rename.

Intead of returning a pointer to dname on failure, this patch returns
a pointer to a copy of the filename.

Reported-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Mimi Zohar &lt;zohar@linux.vnet.ibm.com&gt;
Cc: stable@vger.kernel.org
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
@@ -204,7 +204,7 @@ int ima_store_template(struct ima_template_entry *entry, int violation,
 		       struct inode *inode,
 		       const unsigned char *filename, int pcr);
 void ima_free_template_entry(struct ima_template_entry *entry);
-const char *ima_d_path(const struct path *path, char **pathbuf);
+const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
 
 /* IMA policy related functions */
 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
@@ -318,7 +318,17 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
 	iint->flags |= IMA_AUDITED;
 }
 
-const char *ima_d_path(const struct path *path, char **pathbuf)
+/*
+ * ima_d_path - return a pointer to the full pathname
+ *
+ * Attempt to return a pointer to the full pathname for use in the
+ * IMA measurement list, IMA audit records, and auditing logs.
+ *
+ * On failure, return a pointer to a copy of the filename, not dname.
+ * Returning a pointer to dname, could result in using the pointer
+ * after the memory has been freed.
+ */
+const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
 {
 	char *pathname = NULL;
 
@@ -331,5 +341,11 @@ const char *ima_d_path(const struct path *path, char **pathbuf)
 			pathname = NULL;
 		}
 	}
-	return pathname ?: (const char *)path->dentry->d_name.name;
+
+	if (!pathname) {
+		strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX);
+		pathname = namebuf;
+	}
+
+	return pathname;
 }
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
@@ -83,6 +83,7 @@ static void ima_rdwr_violation_check(struct file *file,
 				     const char **pathname)
 {
 	struct inode *inode = file_inode(file);
+	char filename[NAME_MAX];
 	fmode_t mode = file->f_mode;
 	bool send_tomtou = false, send_writers = false;
 
@@ -102,7 +103,7 @@ static void ima_rdwr_violation_check(struct file *file,
 	if (!send_tomtou && !send_writers)
 		return;
 
-	*pathname = ima_d_path(&file->f_path, pathbuf);
+	*pathname = ima_d_path(&file->f_path, pathbuf, filename);
 
 	if (send_tomtou)
 		ima_add_violation(file, *pathname, iint,
@@ -161,6 +162,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
 	struct integrity_iint_cache *iint = NULL;
 	struct ima_template_desc *template_desc;
 	char *pathbuf = NULL;
+	char filename[NAME_MAX];
 	const char *pathname = NULL;
 	int rc = -ENOMEM, action, must_appraise;
 	int pcr = CONFIG_IMA_MEASURE_PCR_IDX;
@@ -239,8 +241,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
 		goto out_digsig;
 	}
 
-	if (!pathname)	/* ima_rdwr_violation possibly pre-fetched */
-		pathname = ima_d_path(&file->f_path, &pathbuf);
+	if (!pathbuf)	/* ima_rdwr_violation possibly pre-fetched */
+		pathname = ima_d_path(&file->f_path, &pathbuf, filename);
 
 	if (action & IMA_MEASURE)
 		ima_store_measurement(iint, file, pathname,

Original file line number	Diff line number	Diff line change
`@@ -318,7 +318,17 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,`
`318`	`318`	`iint->flags \|= IMA_AUDITED;`
`319`	`319`	`}`
`320`	`320`
`321`		`-const char ima_d_path(const struct path path, char **pathbuf)`
	`321`	`+/*`
	`322`	`+ * ima_d_path - return a pointer to the full pathname`
	`323`	`+ *`
	`324`	`+ * Attempt to return a pointer to the full pathname for use in the`
	`325`	`+ * IMA measurement list, IMA audit records, and auditing logs.`
	`326`	`+ *`
	`327`	`+ * On failure, return a pointer to a copy of the filename, not dname.`
	`328`	`+ * Returning a pointer to dname, could result in using the pointer`
	`329`	`+ * after the memory has been freed.`
	`330`	`+ */`
	`331`	`+const char ima_d_path(const struct path path, char *pathbuf, char namebuf)`
`322`	`332`	`{`
`323`	`333`	`char *pathname = NULL;`
`324`	`334`
`@@ -331,5 +341,11 @@ const char ima_d_path(const struct path path, char **pathbuf)`
`331`	`341`	`pathname = NULL;`
`332`	`342`	`}`
`333`	`343`	`}`
`334`		`- return pathname ?: (const char *)path->dentry->d_name.name;`
	`344`	`+`
	`345`	`+ if (!pathname) {`
	`346`	`+ strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX);`
	`347`	`+ pathname = namebuf;`
	`348`	`+ }`
	`349`	`+`
	`350`	`+ return pathname;`
`335`	`351`	`}`