ima: add support for creating files using the mknodat syscall

Commit 3034a14 "ima: pass 'opened' flag to identify newly created files"
stopped identifying empty files as new files.  However new empty files
can be created using the mknodat syscall.  On systems with IMA-appraisal
enabled, these empty files are not labeled with security.ima extended
attributes properly, preventing them from subsequently being opened in
order to write the file data contents.  This patch defines a new hook
named ima_post_path_mknod() to mark these empty files, created using
mknodat, as new in order to allow the file data contents to be written.

In addition, files with security.ima xattrs containing a file signature
are considered "immutable" and can not be modified.  The file contents
need to be written, before signing the file.  This patch relaxes this
requirement for new files, allowing the file signature to be written
before the file contents.

Changelog:
- defer identifying files with signatures stored as security.ima
  (based on Dmitry Rozhkov's comments)
- removing tests (eg. dentry, dentry->d_inode, inode->i_size == 0)
  (based on Al's review)

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Al Viro <<viro@zeniv.linux.org.uk>
Tested-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>

2 files changed, 29 insertions, 1 deletions

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index d2f28a0c8614..1bcbc12e03d9 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -275,6 +275,11 @@ out:
                      xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
                         if (!ima_fix_xattr(dentry, iint))
                                 status = INTEGRITY_PASS;
+                } else if ((inode->i_size == 0) &&
+                           (iint->flags & IMA_NEW_FILE) &&
+                           (xattr_value &&
+                            xattr_value->type == EVM_IMA_XATTR_DIGSIG)) {
+                        status = INTEGRITY_PASS;
                 }
                 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
                                     op, cause, rc, 0);
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 391f41751021..68b26c340acd 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -246,7 +246,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
                 ima_audit_measurement(iint, pathname);
 
 out_digsig:
-        if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG))
+        if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG) &&
+             !(iint->flags & IMA_NEW_FILE))
                 rc = -EACCES;
         kfree(xattr_value);
 out_free:
@@ -316,6 +317,28 @@ int ima_file_check(struct file *file, int mask, int opened)
 EXPORT_SYMBOL_GPL(ima_file_check);
 
 /**
+ * ima_post_path_mknod - mark as a new inode
+ * @dentry: newly created dentry
+ *
+ * Mark files created via the mknodat syscall as new, so that the
+ * file data can be written later.
+ */
+void ima_post_path_mknod(struct dentry *dentry)
+{
+        struct integrity_iint_cache *iint;
+        struct inode *inode = dentry->d_inode;
+        int must_appraise;
+
+        must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
+        if (!must_appraise)
+                return;
+
+        iint = integrity_inode_get(inode);
+        if (iint)
+                iint->flags |= IMA_NEW_FILE;
+}
+
+/**
  * ima_read_file - pre-measure/appraise hook decision based on policy
  * @file: pointer to the file to be measured/appraised/audit
  * @read_id: caller identifier