aboutsummaryrefslogtreecommitdiffstats
path: root/security/integrity/ima/ima_fs.c
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.vnet.ibm.com>2009-02-04 09:07:01 -0500
committerJames Morris <jmorris@namei.org>2009-02-05 17:05:32 -0500
commitf4bd857bc8ed997c25ec06b56ef8064aafa6d4f3 (patch)
tree5326caddadc6144a1e7dee17a6714344ccefbb11 /security/integrity/ima/ima_fs.c
parent4af4662fa4a9dc62289c580337ae2506339c4729 (diff)
integrity: IMA policy open
Sequentialize access to the policy file - permit multiple attempts to replace default policy with a valid policy Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/integrity/ima/ima_fs.c')
-rw-r--r--security/integrity/ima/ima_fs.c17
1 files changed, 16 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 95ef1caa64b5..573780c76f1f 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -277,16 +277,30 @@ static struct dentry *runtime_measurements_count;
277static struct dentry *violations; 277static struct dentry *violations;
278static struct dentry *ima_policy; 278static struct dentry *ima_policy;
279 279
280static atomic_t policy_opencount = ATOMIC_INIT(1);
281/*
282 * ima_open_policy: sequentialize access to the policy file
283 */
284int ima_open_policy(struct inode * inode, struct file * filp)
285{
286 if (atomic_dec_and_test(&policy_opencount))
287 return 0;
288 return -EBUSY;
289}
290
280/* 291/*
281 * ima_release_policy - start using the new measure policy rules. 292 * ima_release_policy - start using the new measure policy rules.
282 * 293 *
283 * Initially, ima_measure points to the default policy rules, now 294 * Initially, ima_measure points to the default policy rules, now
284 * point to the new policy rules, and remove the securityfs policy file. 295 * point to the new policy rules, and remove the securityfs policy file,
296 * assuming a valid policy.
285 */ 297 */
286static int ima_release_policy(struct inode *inode, struct file *file) 298static int ima_release_policy(struct inode *inode, struct file *file)
287{ 299{
288 if (!valid_policy) { 300 if (!valid_policy) {
289 ima_delete_rules(); 301 ima_delete_rules();
302 valid_policy = 1;
303 atomic_set(&policy_opencount, 1);
290 return 0; 304 return 0;
291 } 305 }
292 ima_update_policy(); 306 ima_update_policy();
@@ -296,6 +310,7 @@ static int ima_release_policy(struct inode *inode, struct file *file)
296} 310}
297 311
298static struct file_operations ima_measure_policy_ops = { 312static struct file_operations ima_measure_policy_ops = {
313 .open = ima_open_policy,
299 .write = ima_write_policy, 314 .write = ima_write_policy,
300 .release = ima_release_policy 315 .release = ima_release_policy
301}; 316};