diff options
author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2012-12-05 15:14:38 -0500 |
---|---|---|
committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2013-01-22 16:10:39 -0500 |
commit | 5a73fcfa8875a94c2956e7ff8fba54d31a3e2854 (patch) | |
tree | 4f7a55a1f4c7524aaa422fc216717c1c0424d48e /security | |
parent | d79d72e02485c00b886179538dc8deaffa3be507 (diff) |
ima: differentiate appraise status only for hook specific rules
Different hooks can require different methods for appraising a
file's integrity. As a result, an integrity appraisal status is
cached on a per hook basis.
Only a hook specific rule, requires the inode to be re-appraised.
This patch eliminates unnecessary appraisals.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Diffstat (limited to 'security')
-rw-r--r-- | security/integrity/ima/ima_main.c | 9 | ||||
-rw-r--r-- | security/integrity/ima/ima_policy.c | 9 |
2 files changed, 12 insertions, 6 deletions
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 66b7f408eff2..3e751a9743a1 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c | |||
@@ -146,7 +146,7 @@ static int process_measurement(struct file *file, const char *filename, | |||
146 | struct integrity_iint_cache *iint; | 146 | struct integrity_iint_cache *iint; |
147 | char *pathbuf = NULL; | 147 | char *pathbuf = NULL; |
148 | const char *pathname = NULL; | 148 | const char *pathname = NULL; |
149 | int rc = -ENOMEM, action, must_appraise; | 149 | int rc = -ENOMEM, action, must_appraise, _func; |
150 | 150 | ||
151 | if (!ima_initialized || !S_ISREG(inode->i_mode)) | 151 | if (!ima_initialized || !S_ISREG(inode->i_mode)) |
152 | return 0; | 152 | return 0; |
@@ -161,6 +161,9 @@ static int process_measurement(struct file *file, const char *filename, | |||
161 | 161 | ||
162 | must_appraise = action & IMA_APPRAISE; | 162 | must_appraise = action & IMA_APPRAISE; |
163 | 163 | ||
164 | /* Is the appraise rule hook specific? */ | ||
165 | _func = (action & IMA_FILE_APPRAISE) ? FILE_CHECK : function; | ||
166 | |||
164 | mutex_lock(&inode->i_mutex); | 167 | mutex_lock(&inode->i_mutex); |
165 | 168 | ||
166 | iint = integrity_inode_get(inode); | 169 | iint = integrity_inode_get(inode); |
@@ -178,7 +181,7 @@ static int process_measurement(struct file *file, const char *filename, | |||
178 | /* Nothing to do, just return existing appraised status */ | 181 | /* Nothing to do, just return existing appraised status */ |
179 | if (!action) { | 182 | if (!action) { |
180 | if (must_appraise) | 183 | if (must_appraise) |
181 | rc = ima_get_cache_status(iint, function); | 184 | rc = ima_get_cache_status(iint, _func); |
182 | goto out_digsig; | 185 | goto out_digsig; |
183 | } | 186 | } |
184 | 187 | ||
@@ -195,7 +198,7 @@ static int process_measurement(struct file *file, const char *filename, | |||
195 | if (action & IMA_MEASURE) | 198 | if (action & IMA_MEASURE) |
196 | ima_store_measurement(iint, file, pathname); | 199 | ima_store_measurement(iint, file, pathname); |
197 | if (action & IMA_APPRAISE_SUBMASK) | 200 | if (action & IMA_APPRAISE_SUBMASK) |
198 | rc = ima_appraise_measurement(function, iint, file, pathname); | 201 | rc = ima_appraise_measurement(_func, iint, file, pathname); |
199 | if (action & IMA_AUDIT) | 202 | if (action & IMA_AUDIT) |
200 | ima_audit_measurement(iint, pathname); | 203 | ima_audit_measurement(iint, pathname); |
201 | kfree(pathbuf); | 204 | kfree(pathbuf); |
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 4d7c0ae656d3..4adcd0f8c1dd 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c | |||
@@ -220,10 +220,13 @@ retry: | |||
220 | 220 | ||
221 | /* | 221 | /* |
222 | * In addition to knowing that we need to appraise the file in general, | 222 | * In addition to knowing that we need to appraise the file in general, |
223 | * we need to differentiate between calling hooks. | 223 | * we need to differentiate between calling hooks, for hook specific rules. |
224 | */ | 224 | */ |
225 | static int get_subaction(int func) | 225 | static int get_subaction(struct ima_rule_entry *rule, int func) |
226 | { | 226 | { |
227 | if (!(rule->flags & IMA_FUNC)) | ||
228 | return IMA_FILE_APPRAISE; | ||
229 | |||
227 | switch(func) { | 230 | switch(func) { |
228 | case MMAP_CHECK: | 231 | case MMAP_CHECK: |
229 | return IMA_MMAP_APPRAISE; | 232 | return IMA_MMAP_APPRAISE; |
@@ -268,7 +271,7 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, | |||
268 | 271 | ||
269 | action |= entry->action & IMA_DO_MASK; | 272 | action |= entry->action & IMA_DO_MASK; |
270 | if (entry->action & IMA_APPRAISE) | 273 | if (entry->action & IMA_APPRAISE) |
271 | action |= get_subaction(func); | 274 | action |= get_subaction(entry, func); |
272 | 275 | ||
273 | if (entry->action & IMA_DO_MASK) | 276 | if (entry->action & IMA_DO_MASK) |
274 | actmask &= ~(entry->action | entry->action << 1); | 277 | actmask &= ~(entry->action | entry->action << 1); |