aboutsummaryrefslogtreecommitdiffstats
path: root/security/integrity
diff options
context:
space:
mode:
authorDmitry Kasatkin <d.kasatkin@samsung.com>2014-09-02 09:31:43 -0400
committerMimi Zohar <zohar@linux.vnet.ibm.com>2014-09-09 10:26:10 -0400
commit3dcbad52cf18c3c379e96b992d22815439ebbe53 (patch)
treea5766bd074a95c62e2c67ccf3a72608a6929bb60 /security/integrity
parentb151d6b00bbb798c58f2f21305e7d43fa763f34f (diff)
evm: properly handle INTEGRITY_NOXATTRS EVM status
Unless an LSM labels a file during d_instantiate(), newly created files are not labeled with an initial security.evm xattr, until the file closes. EVM, before allowing a protected, security xattr to be written, verifies the existing 'security.evm' value is good. For newly created files without a security.evm label, this verification prevents writing any protected, security xattrs, until the file closes. Following is the example when this happens: fd = open("foo", O_CREAT | O_WRONLY, 0644); setxattr("foo", "security.SMACK64", value, sizeof(value), 0); close(fd); While INTEGRITY_NOXATTRS status is handled in other places, such as evm_inode_setattr(), it does not handle it in all cases in evm_protect_xattr(). By limiting the use of INTEGRITY_NOXATTRS to newly created files, we can now allow setting "protected" xattrs. Changelog: - limit the use of INTEGRITY_NOXATTRS to IMA identified new files Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org> 3.14+
Diffstat (limited to 'security/integrity')
-rw-r--r--security/integrity/evm/evm_main.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 40220124364c..9685af330de5 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -285,6 +285,13 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
285 goto out; 285 goto out;
286 } 286 }
287 evm_status = evm_verify_current_integrity(dentry); 287 evm_status = evm_verify_current_integrity(dentry);
288 if (evm_status == INTEGRITY_NOXATTRS) {
289 struct integrity_iint_cache *iint;
290
291 iint = integrity_iint_find(dentry->d_inode);
292 if (iint && (iint->flags & IMA_NEW_FILE))
293 return 0;
294 }
288out: 295out:
289 if (evm_status != INTEGRITY_PASS) 296 if (evm_status != INTEGRITY_PASS)
290 integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode, 297 integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode,