ima: differentiate appraise status only for hook specific rules

Different hooks can require different methods for appraising a
file's integrity.  As a result, an integrity appraisal status is
cached on a per hook basis.

Only a hook specific rule, requires the inode to be re-appraised.
This patch eliminates unnecessary appraisals.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>

1 files changed, 6 insertions, 3 deletions

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 66b7f408eff2..3e751a9743a1 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -146,7 +146,7 @@ static int process_measurement(struct file *file, const char *filename,
         struct integrity_iint_cache *iint;
         char *pathbuf = NULL;
         const char *pathname = NULL;
-        int rc = -ENOMEM, action, must_appraise;
+        int rc = -ENOMEM, action, must_appraise, _func;
 
         if (!ima_initialized || !S_ISREG(inode->i_mode))
                 return 0;
@@ -161,6 +161,9 @@ static int process_measurement(struct file *file, const char *filename,
 
         must_appraise = action & IMA_APPRAISE;
 
+        /*  Is the appraise rule hook specific?  */
+        _func = (action & IMA_FILE_APPRAISE) ? FILE_CHECK : function;
+
         mutex_lock(&inode->i_mutex);
 
         iint = integrity_inode_get(inode);
@@ -178,7 +181,7 @@ static int process_measurement(struct file *file, const char *filename,
         /* Nothing to do, just return existing appraised status */
         if (!action) {
                 if (must_appraise)
-                        rc = ima_get_cache_status(iint, function);
+                        rc = ima_get_cache_status(iint, _func);
                 goto out_digsig;
         }
 
@@ -195,7 +198,7 @@ static int process_measurement(struct file *file, const char *filename,
         if (action & IMA_MEASURE)
                 ima_store_measurement(iint, file, pathname);
         if (action & IMA_APPRAISE_SUBMASK)
-                rc = ima_appraise_measurement(function, iint, file, pathname);
+                rc = ima_appraise_measurement(_func, iint, file, pathname);
         if (action & IMA_AUDIT)
                 ima_audit_measurement(iint, pathname);
         kfree(pathbuf);