aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.vnet.ibm.com>2012-12-05 15:14:38 -0500
committerMimi Zohar <zohar@linux.vnet.ibm.com>2013-01-22 16:10:39 -0500
commit5a73fcfa8875a94c2956e7ff8fba54d31a3e2854 (patch)
tree4f7a55a1f4c7524aaa422fc216717c1c0424d48e /security
parentd79d72e02485c00b886179538dc8deaffa3be507 (diff)
ima: differentiate appraise status only for hook specific rules
Different hooks can require different methods for appraising a file's integrity. As a result, an integrity appraisal status is cached on a per hook basis. Only a hook specific rule, requires the inode to be re-appraised. This patch eliminates unnecessary appraisals. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Diffstat (limited to 'security')
-rw-r--r--security/integrity/ima/ima_main.c9
-rw-r--r--security/integrity/ima/ima_policy.c9
2 files changed, 12 insertions, 6 deletions
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 66b7f408eff2..3e751a9743a1 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -146,7 +146,7 @@ static int process_measurement(struct file *file, const char *filename,
146 struct integrity_iint_cache *iint; 146 struct integrity_iint_cache *iint;
147 char *pathbuf = NULL; 147 char *pathbuf = NULL;
148 const char *pathname = NULL; 148 const char *pathname = NULL;
149 int rc = -ENOMEM, action, must_appraise; 149 int rc = -ENOMEM, action, must_appraise, _func;
150 150
151 if (!ima_initialized || !S_ISREG(inode->i_mode)) 151 if (!ima_initialized || !S_ISREG(inode->i_mode))
152 return 0; 152 return 0;
@@ -161,6 +161,9 @@ static int process_measurement(struct file *file, const char *filename,
161 161
162 must_appraise = action & IMA_APPRAISE; 162 must_appraise = action & IMA_APPRAISE;
163 163
164 /* Is the appraise rule hook specific? */
165 _func = (action & IMA_FILE_APPRAISE) ? FILE_CHECK : function;
166
164 mutex_lock(&inode->i_mutex); 167 mutex_lock(&inode->i_mutex);
165 168
166 iint = integrity_inode_get(inode); 169 iint = integrity_inode_get(inode);
@@ -178,7 +181,7 @@ static int process_measurement(struct file *file, const char *filename,
178 /* Nothing to do, just return existing appraised status */ 181 /* Nothing to do, just return existing appraised status */
179 if (!action) { 182 if (!action) {
180 if (must_appraise) 183 if (must_appraise)
181 rc = ima_get_cache_status(iint, function); 184 rc = ima_get_cache_status(iint, _func);
182 goto out_digsig; 185 goto out_digsig;
183 } 186 }
184 187
@@ -195,7 +198,7 @@ static int process_measurement(struct file *file, const char *filename,
195 if (action & IMA_MEASURE) 198 if (action & IMA_MEASURE)
196 ima_store_measurement(iint, file, pathname); 199 ima_store_measurement(iint, file, pathname);
197 if (action & IMA_APPRAISE_SUBMASK) 200 if (action & IMA_APPRAISE_SUBMASK)
198 rc = ima_appraise_measurement(function, iint, file, pathname); 201 rc = ima_appraise_measurement(_func, iint, file, pathname);
199 if (action & IMA_AUDIT) 202 if (action & IMA_AUDIT)
200 ima_audit_measurement(iint, pathname); 203 ima_audit_measurement(iint, pathname);
201 kfree(pathbuf); 204 kfree(pathbuf);
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 4d7c0ae656d3..4adcd0f8c1dd 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -220,10 +220,13 @@ retry:
220 220
221/* 221/*
222 * In addition to knowing that we need to appraise the file in general, 222 * In addition to knowing that we need to appraise the file in general,
223 * we need to differentiate between calling hooks. 223 * we need to differentiate between calling hooks, for hook specific rules.
224 */ 224 */
225static int get_subaction(int func) 225static int get_subaction(struct ima_rule_entry *rule, int func)
226{ 226{
227 if (!(rule->flags & IMA_FUNC))
228 return IMA_FILE_APPRAISE;
229
227 switch(func) { 230 switch(func) {
228 case MMAP_CHECK: 231 case MMAP_CHECK:
229 return IMA_MMAP_APPRAISE; 232 return IMA_MMAP_APPRAISE;
@@ -268,7 +271,7 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
268 271
269 action |= entry->action & IMA_DO_MASK; 272 action |= entry->action & IMA_DO_MASK;
270 if (entry->action & IMA_APPRAISE) 273 if (entry->action & IMA_APPRAISE)
271 action |= get_subaction(func); 274 action |= get_subaction(entry, func);
272 275
273 if (entry->action & IMA_DO_MASK) 276 if (entry->action & IMA_DO_MASK)
274 actmask &= ~(entry->action | entry->action << 1); 277 actmask &= ~(entry->action | entry->action << 1);