asgardius/android_kernel_motorola_sm6225
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ima: prevent new digsig xattr from being replaced

Browse source 
Even though a new xattr will only be appraised on the next access,
set the DIGSIG flag to prevent a signature from being replaced with
a hash on file close.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
This commit is contained in:
Mimi Zohar 2014-03-17 23:24:18 -04:00
parent 0e04c641b1
commit 060bdebfb0
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
security/integrity/ima/ima_appraise.c
View file

@ -341,7 +341,7 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
return 0; return 0;
} }
static void ima_reset_appraise_flags(struct inode *inode) static void ima_reset_appraise_flags(struct inode *inode, int digsig)
{ {
struct integrity_iint_cache *iint; struct integrity_iint_cache *iint;
@ -353,18 +353,22 @@ static void ima_reset_appraise_flags(struct inode *inode)
return; return;
iint->flags &= ~IMA_DONE_MASK; iint->flags &= ~IMA_DONE_MASK;
if (digsig)
iint->flags |= IMA_DIGSIG;
return; return;
} }
int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
const void *xattr_value, size_t xattr_value_len) const void *xattr_value, size_t xattr_value_len)
{ {
const struct evm_ima_xattr_data *xvalue = xattr_value;
int result; int result;
result = ima_protect_xattr(dentry, xattr_name, xattr_value, result = ima_protect_xattr(dentry, xattr_name, xattr_value,
xattr_value_len); xattr_value_len);
if (result == 1) { if (result == 1) {
ima_reset_appraise_flags(dentry->d_inode); ima_reset_appraise_flags(dentry->d_inode,
(xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
result = 0; result = 0;
} }
return result; return result;
@ -376,7 +380,7 @@ int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
result = ima_protect_xattr(dentry, xattr_name, NULL, 0); result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
if (result == 1) { if (result == 1) {
ima_reset_appraise_flags(dentry->d_inode); ima_reset_appraise_flags(dentry->d_inode, 0);
result = 0; result = 0;
} }
return result; return result;