linux-kernel - [PATCH 3/3] ima: call evm_inode_post_removexattr() in ima_inode_post

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 2 Nov 2010 11:06:25 +0100
From:	Roberto Sassu <roberto.sassu@...ito.it>
To:	linux-kernel@...r.kernel.org,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, James Morris <jmorris@...ei.org>,
	David Safford <safford@...son.ibm.com>,
	Dave Hansen <dave@...ux.vnet.ibm.com>
Subject: [PATCH 3/3] ima: call evm_inode_post_removexattr() in ima_inode_post_setattr()

This patch inserts the call evm_inode_post_removexattr() after removing
the 'security.ima' extended attribute in the function
ima_inode_post_setattr() in order to keep 'security.evm' up to date.

Signed-off-by: Roberto Sassu <roberto.sassu@...ito.it>
---
 security/integrity/ima/ima_main.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 32dadfa..df92f4d 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/xattr.h>
 #include <linux/ima.h>
+#include <linux/evm.h>
 
 #include "ima.h"
 
@@ -365,8 +366,10 @@ void ima_inode_post_setattr(struct dentry *dentry)
 	iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED);
 	must_appraise = ima_must_appraise(iint, inode, MAY_ACCESS,
 					  POST_SETATTR);
-	if (!must_appraise)
+	if (!must_appraise) {
 		rc = inode->i_op->removexattr(dentry, XATTR_NAME_IMA);
+		evm_inode_post_removexattr(dentry, XATTR_NAME_IMA);
+	}
 	mutex_unlock(&iint->mutex);
 	kref_put(&iint->refcount, iint_free);
 	return;
-- 
1.7.2.3


Download attachment "smime.p7s" of type "application/pkcs7-signature" (4707 bytes)