1 files changed, 46 insertions, 40 deletions

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index f4e7266f5aee..6f611874d10e 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -29,20 +29,8 @@ int ima_initialized;
 char *ima_hash = "sha1";
 static int __init hash_setup(char *str)
 {
-        const char *op = "hash_setup";
-        const char *hash = "sha1";
-        int result = 0;
-        int audit_info = 0;
-
-        if (strncmp(str, "md5", 3) == 0) {
-                hash = "md5";
-                ima_hash = str;
-        } else if (strncmp(str, "sha1", 4) != 0) {
-                hash = "invalid_hash_type";
-                result = 1;
-        }
-        integrity_audit_msg(AUDIT_INTEGRITY_HASH, NULL, NULL, op, hash,
-                            result, audit_info);
+        if (strncmp(str, "md5", 3) == 0)
+                ima_hash = "md5";
         return 1;
 }
 __setup("ima_hash=", hash_setup);
@@ -128,10 +116,6 @@ static int get_path_measurement(struct ima_iint_cache *iint, struct file *file,
 {
         int rc = 0;
 
-        if (IS_ERR(file)) {
-                pr_info("%s dentry_open failed\n", filename);
-                return rc;
-        }
         iint->opencount++;
         iint->readcount++;
 
@@ -141,6 +125,15 @@ static int get_path_measurement(struct ima_iint_cache *iint, struct file *file,
         return rc;
 }
 
+static void ima_update_counts(struct ima_iint_cache *iint, int mask)
+{
+        iint->opencount++;
+        if ((mask & MAY_WRITE) || (mask == 0))
+                iint->writecount++;
+        else if (mask & (MAY_READ | MAY_EXEC))
+                iint->readcount++;
+}
+
 /**
  * ima_path_check - based on policy, collect/store measurement.
  * @path: contains a pointer to the path to be measured
@@ -156,10 +149,10 @@ static int get_path_measurement(struct ima_iint_cache *iint, struct file *file,
  *      - Opening a file for read when already open for write,
  *        could result in a file measurement error.
  *
- * Return 0 on success, an error code on failure.
- * (Based on the results of appraise_measurement().)
+ * Always return 0 and audit dentry_open failures.
+ * (Return code will be based upon measurement appraisal.)
  */
-int ima_path_check(struct path *path, int mask)
+int ima_path_check(struct path *path, int mask, int update_counts)
 {
         struct inode *inode = path->dentry->d_inode;
         struct ima_iint_cache *iint;
@@ -173,11 +166,8 @@ int ima_path_check(struct path *path, int mask)
                 return 0;
 
         mutex_lock(&iint->mutex);
-        iint->opencount++;
-        if ((mask & MAY_WRITE) || (mask == 0))
-                iint->writecount++;
-        else if (mask & (MAY_READ | MAY_EXEC))
-                iint->readcount++;
+        if (update_counts)
+                ima_update_counts(iint, mask);
 
         rc = ima_must_measure(iint, inode, MAY_READ, PATH_CHECK);
         if (rc < 0)
@@ -196,7 +186,19 @@ int ima_path_check(struct path *path, int mask)
                 struct dentry *dentry = dget(path->dentry);
                 struct vfsmount *mnt = mntget(path->mnt);
 
-                file = dentry_open(dentry, mnt, O_RDONLY, current->cred);
+                file = dentry_open(dentry, mnt, O_RDONLY | O_LARGEFILE,
+                                   current_cred());
+                if (IS_ERR(file)) {
+                        int audit_info = 0;
+
+                        integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
+                                            dentry->d_name.name,
+                                            "add_measurement",
+                                            "dentry_open failed",
+                                            1, audit_info);
+                        file = NULL;
+                        goto out;
+                }
                 rc = get_path_measurement(iint, file, dentry->d_name.name);
         }
 out:
@@ -206,6 +208,7 @@ out:
         kref_put(&iint->refcount, iint_free);
         return 0;
 }
+EXPORT_SYMBOL_GPL(ima_path_check);
 
 static int process_measurement(struct file *file, const unsigned char *filename,
                                int mask, int function)
@@ -234,7 +237,16 @@ out:
         return rc;
 }
 
-static void opencount_get(struct file *file)
+/*
+ * ima_opens_get - increment file counts
+ *
+ * - for IPC shm and shmat file.
+ * - for nfsd exported files.
+ *
+ * Increment the counts for these files to prevent unnecessary
+ * imbalance messages.
+ */
+void ima_counts_get(struct file *file)
 {
         struct inode *inode = file->f_dentry->d_inode;
         struct ima_iint_cache *iint;
@@ -246,8 +258,14 @@ static void opencount_get(struct file *file)
                 return;
         mutex_lock(&iint->mutex);
         iint->opencount++;
+        if ((file->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ)
+                iint->readcount++;
+
+        if (file->f_mode & FMODE_WRITE)
+                iint->writecount++;
         mutex_unlock(&iint->mutex);
 }
+EXPORT_SYMBOL_GPL(ima_counts_get);
 
 /**
  * ima_file_mmap - based on policy, collect/store measurement.
@@ -272,18 +290,6 @@ int ima_file_mmap(struct file *file, unsigned long prot)
         return 0;
 }
 
-/*
- * ima_shm_check - IPC shm and shmat create/fput a file
- *
- * Maintain the opencount for these files to prevent unnecessary
- * imbalance messages.
- */
-void ima_shm_check(struct file *file)
-{
-        opencount_get(file);
-        return;
-}
-
 /**
  * ima_bprm_check - based on policy, collect/store measurement.
  * @bprm: contains the linux_binprm structure