evm: add evm_inode_init_security to initialize new files

Initialize 'security.evm' for new files.

Changelog v7:
- renamed evm_inode_post_init_security to evm_inode_init_security
- moved struct xattr definition to earlier patch
- allocate xattr name
Changelog v6:
- Use 'struct evm_ima_xattr_data'

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>

1 files changed, 38 insertions, 0 deletions

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 1746c3669c6f..23486355f443 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -98,6 +98,12 @@ static int evm_protected_xattr(const char *req_xattr_name)
                         found = 1;
                         break;
                 }
+                if (strncmp(req_xattr_name,
+                            *xattrname + XATTR_SECURITY_PREFIX_LEN,
+                            strlen(req_xattr_name)) == 0) {
+                        found = 1;
+                        break;
+                }
         }
         return found;
 }
@@ -245,6 +251,38 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
         return;
 }
 
+/*
+ * evm_inode_init_security - initializes security.evm
+ */
+int evm_inode_init_security(struct inode *inode,
+                                 const struct xattr *lsm_xattr,
+                                 struct xattr *evm_xattr)
+{
+        struct evm_ima_xattr_data *xattr_data;
+        int rc;
+
+        if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name))
+                return -EOPNOTSUPP;
+
+        xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
+        if (!xattr_data)
+                return -ENOMEM;
+
+        xattr_data->type = EVM_XATTR_HMAC;
+        rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
+        if (rc < 0)
+                goto out;
+
+        evm_xattr->value = xattr_data;
+        evm_xattr->value_len = sizeof(*xattr_data);
+        evm_xattr->name = kstrdup(XATTR_EVM_SUFFIX, GFP_NOFS);
+        return 0;
+out:
+        kfree(xattr_data);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(evm_inode_init_security);
+
 static struct crypto_hash *tfm_hmac;    /* preload crypto alg */
 static int __init init_evm(void)
 {