diff options
author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2009-02-04 09:07:01 -0500 |
---|---|---|
committer | James Morris <jmorris@namei.org> | 2009-02-05 17:05:32 -0500 |
commit | f4bd857bc8ed997c25ec06b56ef8064aafa6d4f3 (patch) | |
tree | 5326caddadc6144a1e7dee17a6714344ccefbb11 /security/integrity/ima/ima_fs.c | |
parent | 4af4662fa4a9dc62289c580337ae2506339c4729 (diff) |
integrity: IMA policy open
Sequentialize access to the policy file
- permit multiple attempts to replace default policy with a valid policy
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/integrity/ima/ima_fs.c')
-rw-r--r-- | security/integrity/ima/ima_fs.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index 95ef1caa64b5..573780c76f1f 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c | |||
@@ -277,16 +277,30 @@ static struct dentry *runtime_measurements_count; | |||
277 | static struct dentry *violations; | 277 | static struct dentry *violations; |
278 | static struct dentry *ima_policy; | 278 | static struct dentry *ima_policy; |
279 | 279 | ||
280 | static atomic_t policy_opencount = ATOMIC_INIT(1); | ||
281 | /* | ||
282 | * ima_open_policy: sequentialize access to the policy file | ||
283 | */ | ||
284 | int ima_open_policy(struct inode * inode, struct file * filp) | ||
285 | { | ||
286 | if (atomic_dec_and_test(&policy_opencount)) | ||
287 | return 0; | ||
288 | return -EBUSY; | ||
289 | } | ||
290 | |||
280 | /* | 291 | /* |
281 | * ima_release_policy - start using the new measure policy rules. | 292 | * ima_release_policy - start using the new measure policy rules. |
282 | * | 293 | * |
283 | * Initially, ima_measure points to the default policy rules, now | 294 | * Initially, ima_measure points to the default policy rules, now |
284 | * point to the new policy rules, and remove the securityfs policy file. | 295 | * point to the new policy rules, and remove the securityfs policy file, |
296 | * assuming a valid policy. | ||
285 | */ | 297 | */ |
286 | static int ima_release_policy(struct inode *inode, struct file *file) | 298 | static int ima_release_policy(struct inode *inode, struct file *file) |
287 | { | 299 | { |
288 | if (!valid_policy) { | 300 | if (!valid_policy) { |
289 | ima_delete_rules(); | 301 | ima_delete_rules(); |
302 | valid_policy = 1; | ||
303 | atomic_set(&policy_opencount, 1); | ||
290 | return 0; | 304 | return 0; |
291 | } | 305 | } |
292 | ima_update_policy(); | 306 | ima_update_policy(); |
@@ -296,6 +310,7 @@ static int ima_release_policy(struct inode *inode, struct file *file) | |||
296 | } | 310 | } |
297 | 311 | ||
298 | static struct file_operations ima_measure_policy_ops = { | 312 | static struct file_operations ima_measure_policy_ops = { |
313 | .open = ima_open_policy, | ||
299 | .write = ima_write_policy, | 314 | .write = ima_write_policy, |
300 | .release = ima_release_policy | 315 | .release = ima_release_policy |
301 | }; | 316 | }; |