linux-kernel - [PATCH] ima: Simplify the implementation of ima_fs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed,  8 Apr 2020 17:02:54 +0800
From:   Tianjia Zhang <tianjia.zhang@...ux.alibaba.com>
To:     zohar@...ux.ibm.com, dmitry.kasatkin@...il.com, jmorris@...ei.org,
        serge@...lyn.com
Cc:     linux-integrity@...r.kernel.org,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] ima: Simplify the implementation of ima_fs_init function

ima_fs_init() has more redundant code, a lot of repetitive code
makes this function ugly, it is inconvenient to add additional
functions, this patch optimizes the implementation of this function,
uses an array and loop to simplify the function process.

Signed-off-by: Tianjia Zhang <tianjia.zhang@...ux.alibaba.com>
---
 security/integrity/ima/ima_fs.c | 72 ++++++++++++++++-----------------
 1 file changed, 35 insertions(+), 37 deletions(-)

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index a71e822a6e92..6763d6cee78d 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -355,10 +355,6 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
 
 static struct dentry *ima_dir;
 static struct dentry *ima_symlink;
-static struct dentry *binary_runtime_measurements;
-static struct dentry *ascii_runtime_measurements;
-static struct dentry *runtime_measurements_count;
-static struct dentry *violations;
 static struct dentry *ima_policy;
 
 enum ima_fs_flags {
@@ -447,8 +443,24 @@ static const struct file_operations ima_measure_policy_ops = {
 	.llseek = generic_file_llseek,
 };
 
+static struct ima_fs_file {
+	const char *name;
+	const struct file_operations *fops;
+	struct dentry *dentry;
+} ima_fs_entries[] = {
+	{ "binary_runtime_measurements", &ima_measurements_ops },
+	{ "ascii_runtime_measurements", &ima_ascii_measurements_ops },
+	{ "runtime_measurements_count", &ima_measurements_count_ops },
+	{ "violations", &ima_htable_violations_ops },
+	{ NULL }
+};
+
 int __init ima_fs_init(void)
 {
+	struct dentry *dentry;
+	struct ima_fs_file *iff;
+	int i;
+
 	ima_dir = securityfs_create_dir("ima", integrity_dir);
 	if (IS_ERR(ima_dir))
 		return -1;
@@ -458,47 +470,33 @@ int __init ima_fs_init(void)
 	if (IS_ERR(ima_symlink))
 		goto out;
 
-	binary_runtime_measurements =
-	    securityfs_create_file("binary_runtime_measurements",
-				   S_IRUSR | S_IRGRP, ima_dir, NULL,
-				   &ima_measurements_ops);
-	if (IS_ERR(binary_runtime_measurements))
+	ima_policy = securityfs_create_file("ima_policy", POLICY_FILE_FLAGS,
+					ima_dir, NULL,
+					&ima_measure_policy_ops);
+	if (IS_ERR(ima_policy))
 		goto out;
 
-	ascii_runtime_measurements =
-	    securityfs_create_file("ascii_runtime_measurements",
-				   S_IRUSR | S_IRGRP, ima_dir, NULL,
-				   &ima_ascii_measurements_ops);
-	if (IS_ERR(ascii_runtime_measurements))
-		goto out;
+	for (i = 0; ; i++) {
+		iff = &ima_fs_entries[i];
+		if (!iff->name)
+			return 0;
 
-	runtime_measurements_count =
-	    securityfs_create_file("runtime_measurements_count",
-				   S_IRUSR | S_IRGRP, ima_dir, NULL,
-				   &ima_measurements_count_ops);
-	if (IS_ERR(runtime_measurements_count))
-		goto out;
+		dentry = securityfs_create_file(iff->name, S_IRUSR | S_IRGRP,
+						ima_dir, NULL, iff->fops);
+		if (IS_ERR(dentry))
+			break;
 
-	violations =
-	    securityfs_create_file("violations", S_IRUSR | S_IRGRP,
-				   ima_dir, NULL, &ima_htable_violations_ops);
-	if (IS_ERR(violations))
-		goto out;
+		iff->dentry = dentry;
+	}
 
-	ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS,
-					    ima_dir, NULL,
-					    &ima_measure_policy_ops);
-	if (IS_ERR(ima_policy))
-		goto out;
+	for (i--; i >= 0; i--) {
+		iff = &ima_fs_entries[i];
+		securityfs_remove(iff->dentry);
+		iff->dentry = NULL;
+	}
 
-	return 0;
 out:
-	securityfs_remove(violations);
-	securityfs_remove(runtime_measurements_count);
-	securityfs_remove(ascii_runtime_measurements);
-	securityfs_remove(binary_runtime_measurements);
 	securityfs_remove(ima_symlink);
 	securityfs_remove(ima_dir);
-	securityfs_remove(ima_policy);
 	return -1;
 }
-- 
2.17.1