05d1a717ec
Commit 3034a14 "ima: pass 'opened' flag to identify newly created files"
stopped identifying empty files as new files. However new empty files
can be created using the mknodat syscall. On systems with IMA-appraisal
enabled, these empty files are not labeled with security.ima extended
attributes properly, preventing them from subsequently being opened in
order to write the file data contents. This patch defines a new hook
named ima_post_path_mknod() to mark these empty files, created using
mknodat, as new in order to allow the file data contents to be written.
In addition, files with security.ima xattrs containing a file signature
are considered "immutable" and can not be modified. The file contents
need to be written, before signing the file. This patch relaxes this
requirement for new files, allowing the file signature to be written
before the file contents.
Changelog:
- defer identifying files with signatures stored as security.ima
(based on Dmitry Rozhkov's comments)
- removing tests (eg. dentry, dentry->d_inode, inode->i_size == 0)
(based on Al's review)
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Al Viro <<viro@zeniv.linux.org.uk>
Tested-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
91 lines
2.2 KiB
C
91 lines
2.2 KiB
C
/*
|
|
* Copyright (C) 2008 IBM Corporation
|
|
* Author: Mimi Zohar <zohar@us.ibm.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, version 2 of the License.
|
|
*/
|
|
|
|
#ifndef _LINUX_IMA_H
|
|
#define _LINUX_IMA_H
|
|
|
|
#include <linux/fs.h>
|
|
struct linux_binprm;
|
|
|
|
#ifdef CONFIG_IMA
|
|
extern int ima_bprm_check(struct linux_binprm *bprm);
|
|
extern int ima_file_check(struct file *file, int mask, int opened);
|
|
extern void ima_file_free(struct file *file);
|
|
extern int ima_file_mmap(struct file *file, unsigned long prot);
|
|
extern int ima_read_file(struct file *file, enum kernel_read_file_id id);
|
|
extern int ima_post_read_file(struct file *file, void *buf, loff_t size,
|
|
enum kernel_read_file_id id);
|
|
extern void ima_post_path_mknod(struct dentry *dentry);
|
|
|
|
#else
|
|
static inline int ima_bprm_check(struct linux_binprm *bprm)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ima_file_check(struct file *file, int mask, int opened)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ima_file_free(struct file *file)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline int ima_file_mmap(struct file *file, unsigned long prot)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ima_read_file(struct file *file, enum kernel_read_file_id id)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ima_post_read_file(struct file *file, void *buf, loff_t size,
|
|
enum kernel_read_file_id id)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ima_post_path_mknod(struct dentry *dentry)
|
|
{
|
|
return;
|
|
}
|
|
|
|
#endif /* CONFIG_IMA */
|
|
|
|
#ifdef CONFIG_IMA_APPRAISE
|
|
extern void ima_inode_post_setattr(struct dentry *dentry);
|
|
extern int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
|
|
const void *xattr_value, size_t xattr_value_len);
|
|
extern int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name);
|
|
#else
|
|
static inline void ima_inode_post_setattr(struct dentry *dentry)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline int ima_inode_setxattr(struct dentry *dentry,
|
|
const char *xattr_name,
|
|
const void *xattr_value,
|
|
size_t xattr_value_len)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ima_inode_removexattr(struct dentry *dentry,
|
|
const char *xattr_name)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif /* CONFIG_IMA_APPRAISE */
|
|
#endif /* _LINUX_IMA_H */
|