ima: add ima_inode_setxattr/removexattr function and calls

Based on xattr_permission comments, the restriction to modify 'security'
xattr is left up to the underlying fs or lsm. Ensure that not just anyone
can modify or remove 'security.ima'.

Changelog v1:
- Unless IMA-APPRAISE is configured, use stub ima_inode_removexattr()/setxattr()
  functions.  (Moved ima_inode_removexattr()/setxattr() to ima_appraise.c)

Changelog:
  - take i_mutex to fix locking (Dmitry Kasatkin)
  - ima_reset_appraise_flags should only be called when modifying or
    removing the 'security.ima' xattr. Requires CAP_SYS_ADMIN privilege.
    (Incorporated fix from Roberto Sassu)
  - Even if allowed to update security.ima, reset the appraisal flags,
    forcing re-appraisal.
  - Replace CAP_MAC_ADMIN with CAP_SYS_ADMIN
  - static inline ima_inode_setxattr()/ima_inode_removexattr() stubs
  - ima_protect_xattr should be static

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/security/security.c b/security/security.c
index 68c1b9b45d93..d23b43522a5a 100644
--- a/security/security.c
+++ b/security/security.c
@@ -573,6 +573,9 @@ int security_inode_setxattr(struct dentry *dentry, const char *name,
         ret = security_ops->inode_setxattr(dentry, name, value, size, flags);
         if (ret)
                 return ret;
+        ret = ima_inode_setxattr(dentry, name, value, size);
+        if (ret)
+                return ret;
         return evm_inode_setxattr(dentry, name, value, size);
 }
 
@@ -608,6 +611,9 @@ int security_inode_removexattr(struct dentry *dentry, const char *name)
         ret = security_ops->inode_removexattr(dentry, name);
         if (ret)
                 return ret;
+        ret = ima_inode_removexattr(dentry, name);
+        if (ret)
+                return ret;
         return evm_inode_removexattr(dentry, name);
 }