linux-kernel - [PATCH 1/3] evm: added flag IMA_NEW in the integrity_iint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <201011021105.55746.roberto.sassu@polito.it>
Date:	Tue, 2 Nov 2010 11:05:55 +0100
From:	Roberto Sassu <roberto.sassu@...ito.it>
To:	linux-kernel@...r.kernel.org,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, James Morris <jmorris@...ei.org>,
	David Safford <safford@...son.ibm.com>,
	Dave Hansen <dave@...ux.vnet.ibm.com>
Subject: [PATCH 1/3] evm: added flag IMA_NEW in the integrity_iint_cache structure

The flag IMA_NEW is set in the function evm_inode_post_init_security()
to distinguish between new and existent files and it is cleared in the
function ima_dec_counts(). This permits to check/fix the 'security.ima'
extended attribute properly in the function ima_appraise_measurement()
without verifying the 'version' field of the 'integrity_iint_cache'
structure.
The 'i_version' field of the inode is not suitable for determining if a
file is being created because the value '1' may be assumed by inodes
already in the filesystem before mounting the same with the parameter
'iversion' as well as those newly created.

Signed-off-by: Roberto Sassu <roberto.sassu@...ito.it>
---
 security/integrity/evm/evm_main.c     |   23 ++++++++++++++++++++---
 security/integrity/ima/ima_appraise.c |    2 +-
 security/integrity/ima/ima_main.c     |    2 +-
 security/integrity/integrity.h        |    1 +
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index cca6410..db5e66f 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -274,14 +274,25 @@ int evm_inode_post_init_security(struct inode *inode, const struct xattr *lsm_xa
 {
 	u8 *hmac_val;
 	int rc;
+	struct integrity_iint_cache *iint;
 
 	if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name))
 		return -EOPNOTSUPP;
 
-	hmac_val = kzalloc(MAX_DIGEST_SIZE, GFP_NOFS);
-	if (!hmac_val)
+	iint = integrity_iint_find_get(inode);
+	if (!iint)
 		return -ENOMEM;
 
+	mutex_lock(&iint->mutex);
+	iint->flags |= IMA_NEW;
+	mutex_unlock(&iint->mutex);
+
+	hmac_val = kzalloc(MAX_DIGEST_SIZE, GFP_NOFS);
+	if (!hmac_val) {
+		rc = -ENOMEM;
+		goto outnofree;
+	}
+
 	rc = evm_init_hmac(inode, lsm_xattr, hmac_val);
 	if (rc < 0)
 		goto out;
@@ -289,9 +300,15 @@ int evm_inode_post_init_security(struct inode *inode, const struct xattr *lsm_xa
 	evm_xattr->value = hmac_val;
 	evm_xattr->value_len = evm_hmac_size;
 	evm_xattr->name = XATTR_EVM_SUFFIX;
-	return 0;
+	goto outrelease;
 out:
 	kfree(hmac_val);
+outnofree:
+	mutex_lock(&iint->mutex);
+	iint->flags &= ~IMA_NEW;
+	mutex_unlock(&iint->mutex);
+outrelease:
+	kref_put(&iint->refcount, iint_free);
 	return rc;
 }
 EXPORT_SYMBOL_GPL(evm_inode_post_init_security);
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index fb402fa..b0256e6 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -114,7 +114,7 @@ int ima_appraise_measurement(struct integrity_iint_cache *iint,
 	return status;
 err_out:
 	if (rc == -ENODATA) {
-		if (iint->version == 1)
+		if (iint->flags & IMA_NEW)
 			return 0;
 		cause = "missing-hash";
 		if (ima_appraise & IMA_APPRAISE_FIX)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 14c39a5..cd29bf2 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -197,7 +197,7 @@ static void ima_dec_counts(struct integrity_iint_cache *iint,
 		if (iint->writecount == 0) {
 			if (iint->version != inode->i_version) {
 				iint->flags &= ~(IMA_COLLECTED | IMA_APPRAISED
-						 | IMA_MEASURED);
+						 | IMA_MEASURED | IMA_NEW);
 				if (iint->flags & IMA_APPRAISE)
 					ima_update_xattr(iint, file);
 			}
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 3a9b3de..a25b019 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -23,6 +23,7 @@
 #define IMA_APPRAISE		4
 #define IMA_APPRAISED		8
 #define IMA_COLLECTED		16
+#define IMA_NEW			32
 
 /* integrity data associated with an inode */
 struct integrity_iint_cache {
-- 
1.7.2.3


Download attachment "smime.p7s" of type "application/pkcs7-signature" (4707 bytes)