5 files changed, 127 insertions, 56 deletions

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index c6ae42266270..08fe405338e1 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -175,7 +175,7 @@ err_out:
  */
 int ima_get_action(struct inode *inode, int mask, enum ima_hooks func, int *pcr)
 {
-        int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE;
+        int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
 
         flags &= ima_policy_flag;
 
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 65fbcf3c32c7..f2803a40ff82 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -46,14 +46,15 @@ bool is_ima_appraise_enabled(void)
 /*
  * ima_must_appraise - set appraise flag
  *
- * Return 1 to appraise
+ * Return 1 to appraise or hash
  */
 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
 {
         if (!ima_appraise)
                 return 0;
 
-        return ima_match_policy(inode, func, mask, IMA_APPRAISE, NULL);
+        return ima_match_policy(inode, func, mask, IMA_APPRAISE | IMA_HASH,
+                                NULL);
 }
 
 static int ima_fix_xattr(struct dentry *dentry,
@@ -223,13 +224,16 @@ int ima_appraise_measurement(enum ima_hooks func,
                 if (opened & FILE_CREATED)
                         iint->flags |= IMA_NEW_FILE;
                 if ((iint->flags & IMA_NEW_FILE) &&
-                    !(iint->flags & IMA_DIGSIG_REQUIRED))
+                    (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
+                     (inode->i_size == 0)))
                         status = INTEGRITY_PASS;
                 goto out;
         }
 
         status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
-        if ((status != INTEGRITY_PASS) && (status != INTEGRITY_UNKNOWN)) {
+        if ((status != INTEGRITY_PASS) &&
+            (status != INTEGRITY_PASS_IMMUTABLE) &&
+            (status != INTEGRITY_UNKNOWN)) {
                 if ((status == INTEGRITY_NOLABEL)
                     || (status == INTEGRITY_NOXATTRS))
                         cause = "missing-HMAC";
@@ -248,6 +252,7 @@ int ima_appraise_measurement(enum ima_hooks func,
                         status = INTEGRITY_FAIL;
                         break;
                 }
+                clear_bit(IMA_DIGSIG, &iint->atomic_flags);
                 if (xattr_len - sizeof(xattr_value->type) - hash_start >=
                                 iint->ima_hash->length)
                         /* xattr length may be longer. md5 hash in previous
@@ -266,7 +271,7 @@ int ima_appraise_measurement(enum ima_hooks func,
                 status = INTEGRITY_PASS;
                 break;
         case EVM_IMA_XATTR_DIGSIG:
-                iint->flags |= IMA_DIGSIG;
+                set_bit(IMA_DIGSIG, &iint->atomic_flags);
                 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
                                              (const char *)xattr_value, rc,
                                              iint->ima_hash->digest,
@@ -317,17 +322,20 @@ void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
         int rc = 0;
 
         /* do not collect and update hash for digital signatures */
-        if (iint->flags & IMA_DIGSIG)
+        if (test_bit(IMA_DIGSIG, &iint->atomic_flags))
                 return;
 
-        if (iint->ima_file_status != INTEGRITY_PASS)
+        if ((iint->ima_file_status != INTEGRITY_PASS) &&
+            !(iint->flags & IMA_HASH))
                 return;
 
         rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo);
         if (rc < 0)
                 return;
 
+        inode_lock(file_inode(file));
         ima_fix_xattr(dentry, iint);
+        inode_unlock(file_inode(file));
 }
 
 /**
@@ -343,23 +351,21 @@ void ima_inode_post_setattr(struct dentry *dentry)
 {
         struct inode *inode = d_backing_inode(dentry);
         struct integrity_iint_cache *iint;
-        int must_appraise;
+        int action;
 
         if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
             || !(inode->i_opflags & IOP_XATTR))
                 return;
 
-        must_appraise = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
+        action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
+        if (!action)
+                __vfs_removexattr(dentry, XATTR_NAME_IMA);
         iint = integrity_iint_find(inode);
         if (iint) {
-                iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED |
-                                 IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
-                                 IMA_ACTION_RULE_FLAGS);
-                if (must_appraise)
-                        iint->flags |= IMA_APPRAISE;
+                set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
+                if (!action)
+                        clear_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
         }
-        if (!must_appraise)
-                __vfs_removexattr(dentry, XATTR_NAME_IMA);
 }
 
 /*
@@ -388,12 +394,12 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
         iint = integrity_iint_find(inode);
         if (!iint)
                 return;
-
-        iint->flags &= ~IMA_DONE_MASK;
         iint->measured_pcrs = 0;
+        set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
         if (digsig)
-                iint->flags |= IMA_DIGSIG;
-        return;
+                set_bit(IMA_DIGSIG, &iint->atomic_flags);
+        else
+                clear_bit(IMA_DIGSIG, &iint->atomic_flags);
 }
 
 int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 06a70c5a2329..061425dd6400 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -85,10 +85,10 @@ static void ima_rdwr_violation_check(struct file *file,
                                      struct integrity_iint_cache *iint,
                                      int must_measure,
                                      char **pathbuf,
-                                     const char **pathname)
+                                     const char **pathname,
+                                     char *filename)
 {
         struct inode *inode = file_inode(file);
-        char filename[NAME_MAX];
         fmode_t mode = file->f_mode;
         bool send_tomtou = false, send_writers = false;
 
@@ -97,10 +97,13 @@ static void ima_rdwr_violation_check(struct file *file,
                         if (!iint)
                                 iint = integrity_iint_find(inode);
                         /* IMA_MEASURE is set from reader side */
-                        if (iint && (iint->flags & IMA_MEASURE))
+                        if (iint && test_bit(IMA_MUST_MEASURE,
+                                                &iint->atomic_flags))
                                 send_tomtou = true;
                 }
         } else {
+                if (must_measure)
+                        set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
                 if ((atomic_read(&inode->i_writecount) > 0) && must_measure)
                         send_writers = true;
         }
@@ -122,22 +125,25 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
                                   struct inode *inode, struct file *file)
 {
         fmode_t mode = file->f_mode;
+        bool update;
 
         if (!(mode & FMODE_WRITE))
                 return;
 
-        inode_lock(inode);
+        mutex_lock(&iint->mutex);
         if (atomic_read(&inode->i_writecount) == 1) {
+                update = test_and_clear_bit(IMA_UPDATE_XATTR,
+                                            &iint->atomic_flags);
                 if (!IS_I_VERSION(inode) ||
                     inode_cmp_iversion(inode, iint->version) ||
                     (iint->flags & IMA_NEW_FILE)) {
                         iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
                         iint->measured_pcrs = 0;
-                        if (iint->flags & IMA_APPRAISE)
+                        if (update)
                                 ima_update_xattr(iint, file);
                 }
         }
-        inode_unlock(inode);
+        mutex_unlock(&iint->mutex);
 }
 
 /**
@@ -170,7 +176,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
         char *pathbuf = NULL;
         char filename[NAME_MAX];
         const char *pathname = NULL;
-        int rc = -ENOMEM, action, must_appraise;
+        int rc = 0, action, must_appraise = 0;
         int pcr = CONFIG_IMA_MEASURE_PCR_IDX;
         struct evm_ima_xattr_data *xattr_value = NULL;
         int xattr_len = 0;
@@ -201,17 +207,31 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
         if (action) {
                 iint = integrity_inode_get(inode);
                 if (!iint)
-                        goto out;
+                        rc = -ENOMEM;
         }
 
-        if (violation_check) {
+        if (!rc && violation_check)
                 ima_rdwr_violation_check(file, iint, action & IMA_MEASURE,
-                                         &pathbuf, &pathname);
-                if (!action) {
-                        rc = 0;
-                        goto out_free;
-                }
-        }
+                                         &pathbuf, &pathname, filename);
+
+        inode_unlock(inode);
+
+        if (rc)
+                goto out;
+        if (!action)
+                goto out;
+
+        mutex_lock(&iint->mutex);
+
+        if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags))
+                /* reset appraisal flags if ima_inode_post_setattr was called */
+                iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED |
+                                 IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
+                                 IMA_ACTION_FLAGS);
+
+        if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags))
+                /* reset all flags if ima_inode_setxattr was called */
+                iint->flags &= ~IMA_DONE_MASK;
 
         /* Determine if already appraised/measured based on bitmask
          * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
@@ -225,11 +245,23 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
         if ((action & IMA_MEASURE) && (iint->measured_pcrs & (0x1 << pcr)))
                 action ^= IMA_MEASURE;
 
+        /* HASH sets the digital signature and update flags, nothing else */
+        if ((action & IMA_HASH) &&
+            !(test_bit(IMA_DIGSIG, &iint->atomic_flags))) {
+                xattr_len = ima_read_xattr(file_dentry(file), &xattr_value);
+                if ((xattr_value && xattr_len > 2) &&
+                    (xattr_value->type == EVM_IMA_XATTR_DIGSIG))
+                        set_bit(IMA_DIGSIG, &iint->atomic_flags);
+                iint->flags |= IMA_HASHED;
+                action ^= IMA_HASH;
+                set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
+        }
+
         /* Nothing to do, just return existing appraised status */
         if (!action) {
                 if (must_appraise)
                         rc = ima_get_cache_status(iint, func);
-                goto out_digsig;
+                goto out_locked;
         }
 
         template_desc = ima_template_desc_current();
@@ -242,7 +274,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
 
         rc = ima_collect_measurement(iint, file, buf, size, hash_algo);
         if (rc != 0 && rc != -EBADF && rc != -EINVAL)
-                goto out_digsig;
+                goto out_locked;
 
         if (!pathbuf)   /* ima_rdwr_violation possibly pre-fetched */
                 pathname = ima_d_path(&file->f_path, &pathbuf, filename);
@@ -250,26 +282,32 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
         if (action & IMA_MEASURE)
                 ima_store_measurement(iint, file, pathname,
                                       xattr_value, xattr_len, pcr);
-        if (rc == 0 && (action & IMA_APPRAISE_SUBMASK))
+        if (rc == 0 && (action & IMA_APPRAISE_SUBMASK)) {
+                inode_lock(inode);
                 rc = ima_appraise_measurement(func, iint, file, pathname,
                                               xattr_value, xattr_len, opened);
+                inode_unlock(inode);
+        }
         if (action & IMA_AUDIT)
                 ima_audit_measurement(iint, pathname);
 
         if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))
                 rc = 0;
-out_digsig:
-        if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG) &&
+out_locked:
+        if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) &&
              !(iint->flags & IMA_NEW_FILE))
                 rc = -EACCES;
+        mutex_unlock(&iint->mutex);
         kfree(xattr_value);
-out_free:
+out:
         if (pathbuf)
                 __putname(pathbuf);
-out:
-        inode_unlock(inode);
-        if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE))
-                return -EACCES;
+        if (must_appraise) {
+                if (rc && (ima_appraise & IMA_APPRAISE_ENFORCE))
+                        return -EACCES;
+                if (file->f_mode & FMODE_WRITE)
+                        set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
+        }
         return 0;
 }
 
@@ -368,8 +406,10 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id)
 
         if (!file && read_id == READING_MODULE) {
                 if (!sig_enforce && (ima_appraise & IMA_APPRAISE_MODULES) &&
-                    (ima_appraise & IMA_APPRAISE_ENFORCE))
+                    (ima_appraise & IMA_APPRAISE_ENFORCE)) {
+                        pr_err("impossible to appraise a module without a file descriptor. sig_enforce kernel parameter might help\n");
                         return -EACCES; /* INTEGRITY_UNKNOWN */
+                }
                 return 0;       /* We rely on module signature checking */
         }
         return 0;
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index ee4613fa5840..915f5572c6ff 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -40,6 +40,8 @@
 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
 #define DONT_APPRAISE   0x0008
 #define AUDIT           0x0040
+#define HASH            0x0100
+#define DONT_HASH       0x0200
 
 #define INVALID_PCR(a) (((a) < 0) || \
         (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
@@ -380,8 +382,10 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
                 action |= entry->flags & IMA_ACTION_FLAGS;
 
                 action |= entry->action & IMA_DO_MASK;
-                if (entry->action & IMA_APPRAISE)
+                if (entry->action & IMA_APPRAISE) {
                         action |= get_subaction(entry, func);
+                        action ^= IMA_HASH;
+                }
 
                 if (entry->action & IMA_DO_MASK)
                         actmask &= ~(entry->action | entry->action << 1);
@@ -521,7 +525,7 @@ enum {
         Opt_err = -1,
         Opt_measure = 1, Opt_dont_measure,
         Opt_appraise, Opt_dont_appraise,
-        Opt_audit,
+        Opt_audit, Opt_hash, Opt_dont_hash,
         Opt_obj_user, Opt_obj_role, Opt_obj_type,
         Opt_subj_user, Opt_subj_role, Opt_subj_type,
         Opt_func, Opt_mask, Opt_fsmagic,
@@ -538,6 +542,8 @@ static match_table_t policy_tokens = {
         {Opt_appraise, "appraise"},
         {Opt_dont_appraise, "dont_appraise"},
         {Opt_audit, "audit"},
+        {Opt_hash, "hash"},
+        {Opt_dont_hash, "dont_hash"},
         {Opt_obj_user, "obj_user=%s"},
         {Opt_obj_role, "obj_role=%s"},
         {Opt_obj_type, "obj_type=%s"},
@@ -671,6 +677,22 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 
                         entry->action = AUDIT;
                         break;
+                case Opt_hash:
+                        ima_log_string(ab, "action", "hash");
+
+                        if (entry->action != UNKNOWN)
+                                result = -EINVAL;
+
+                        entry->action = HASH;
+                        break;
+                case Opt_dont_hash:
+                        ima_log_string(ab, "action", "dont_hash");
+
+                        if (entry->action != UNKNOWN)
+                                result = -EINVAL;
+
+                        entry->action = DONT_HASH;
+                        break;
                 case Opt_func:
                         ima_log_string(ab, "func", args[0].from);
 
@@ -743,7 +765,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
                 case Opt_fsuuid:
                         ima_log_string(ab, "fsuuid", args[0].from);
 
-                        if (uuid_is_null(&entry->fsuuid)) {
+                        if (!uuid_is_null(&entry->fsuuid)) {
                                 result = -EINVAL;
                                 break;
                         }
@@ -1040,6 +1062,10 @@ int ima_policy_show(struct seq_file *m, void *v)
                 seq_puts(m, pt(Opt_dont_appraise));
         if (entry->action & AUDIT)
                 seq_puts(m, pt(Opt_audit));
+        if (entry->action & HASH)
+                seq_puts(m, pt(Opt_hash));
+        if (entry->action & DONT_HASH)
+                seq_puts(m, pt(Opt_dont_hash));
 
         seq_puts(m, " ");
 
diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
index 7412d0291ab9..30db39b23804 100644
--- a/security/integrity/ima/ima_template.c
+++ b/security/integrity/ima/ima_template.c
@@ -377,8 +377,7 @@ int ima_restore_measurement_list(loff_t size, void *buf)
                         break;
 
                 if (hdr[HDR_TEMPLATE_NAME].len >= MAX_TEMPLATE_NAME_LEN) {
-                        pr_err("attempting to restore a template name \
-                                that is too long\n");
+                        pr_err("attempting to restore a template name that is too long\n");
                         ret = -EINVAL;
                         break;
                 }
@@ -389,8 +388,8 @@ int ima_restore_measurement_list(loff_t size, void *buf)
                 template_name[hdr[HDR_TEMPLATE_NAME].len] = 0;
 
                 if (strcmp(template_name, "ima") == 0) {
-                        pr_err("attempting to restore an unsupported \
-                                template \"%s\" failed\n", template_name);
+                        pr_err("attempting to restore an unsupported template \"%s\" failed\n",
+                               template_name);
                         ret = -EINVAL;
                         break;
                 }
@@ -410,8 +409,8 @@ int ima_restore_measurement_list(loff_t size, void *buf)
                                                 &(template_desc->fields),
                                                 &(template_desc->num_fields));
                 if (ret < 0) {
-                        pr_err("attempting to restore the template fmt \"%s\" \
-                                failed\n", template_desc->fmt);
+                        pr_err("attempting to restore the template fmt \"%s\" failed\n",
+                               template_desc->fmt);
                         ret = -EINVAL;
                         break;
                 }