integrity: IMA hooks

This patch replaces the generic integrity hooks, for which IMA registered
itself, with IMA integrity hooks in the appropriate places directly
in the fs directory.

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 17 insertions, 7 deletions

diff --git a/fs/inode.c b/fs/inode.c
index 098a2443196f..ed22b14f2202 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -17,6 +17,7 @@
 #include <linux/hash.h>
 #include <linux/swap.h>
 #include <linux/security.h>
+#include <linux/ima.h>
 #include <linux/pagemap.h>
 #include <linux/cdev.h>
 #include <linux/bootmem.h>
@@ -144,13 +145,13 @@ struct inode *inode_init_always(struct super_block *sb, struct inode *inode)
         inode->i_cdev = NULL;
         inode->i_rdev = 0;
         inode->dirtied_when = 0;
-        if (security_inode_alloc(inode)) {
-                if (inode->i_sb->s_op->destroy_inode)
-                        inode->i_sb->s_op->destroy_inode(inode);
-                else
-                        kmem_cache_free(inode_cachep, (inode));
-                return NULL;
-        }
+
+        if (security_inode_alloc(inode))
+                goto out_free_inode;
+
+        /* allocate and initialize an i_integrity */
+        if (ima_inode_alloc(inode))
+                goto out_free_security;
 
         spin_lock_init(&inode->i_lock);
         lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
@@ -186,6 +187,15 @@ struct inode *inode_init_always(struct super_block *sb, struct inode *inode)
         inode->i_mapping = mapping;
 
         return inode;
+
+out_free_security:
+        security_inode_free(inode);
+out_free_inode:
+        if (inode->i_sb->s_op->destroy_inode)
+                inode->i_sb->s_op->destroy_inode(inode);
+        else
+                kmem_cache_free(inode_cachep, (inode));
+        return NULL;
 }
 EXPORT_SYMBOL(inode_init_always);