Commit 6146f0d5 authored by Mimi Zohar's avatar Mimi Zohar Committed by James Morris
Browse files

integrity: IMA hooks 



This patch replaces the generic integrity hooks, for which IMA registered
itself, with IMA integrity hooks in the appropriate places directly
in the fs directory.

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Acked-by: default avatarSerge Hallyn <serue@us.ibm.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 659aaf2b

Documentation/kernel-parameters.txt

+1 −0
Original line number Diff line number Diff line
@@ -44,6 +44,7 @@ parameter is applicable: 
	FB	The frame buffer device is enabled.

	HW	Appropriate hardware is enabled.

	IA-64	IA-64 architecture is enabled.

	IMA     Integrity measurement architecture is enabled.

	IOSCHED	More than one I/O scheduler is enabled.

	IP_PNP	IP DHCP, BOOTP, or RARP is enabled.

	ISAPNP	ISA PnP code is enabled.

fs/exec.c

+10 −0
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ 
#include <linux/proc_fs.h>

#include <linux/mount.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/syscalls.h>

#include <linux/tsacct_kern.h>

#include <linux/cn_proc.h>
@@ -128,6 +129,9 @@ asmlinkage long sys_uselib(const char __user * library) 
		goto exit;



	error = vfs_permission(&nd, MAY_READ | MAY_EXEC | MAY_OPEN);

	if (error)

		goto exit;

	error = ima_path_check(&nd.path, MAY_READ | MAY_EXEC | MAY_OPEN);

	if (error)

		goto exit;
@@ -681,6 +685,9 @@ struct file *open_exec(const char *name) 
		goto out_path_put;



	err = vfs_permission(&nd, MAY_EXEC | MAY_OPEN);

	if (err)

		goto out_path_put;

	err = ima_path_check(&nd.path, MAY_EXEC | MAY_OPEN);

	if (err)

		goto out_path_put;
@@ -1207,6 +1214,9 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) 
	}

#endif

	retval = security_bprm_check(bprm);

	if (retval)

		return retval;

	retval = ima_bprm_check(bprm);

	if (retval)

		return retval;

fs/file_table.c

+2 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include <linux/module.h>

#include <linux/fs.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/eventpoll.h>

#include <linux/rcupdate.h>

#include <linux/mount.h>
@@ -276,6 +277,7 @@ void __fput(struct file *file) 
	if (file->f_op && file->f_op->release)

		file->f_op->release(inode, file);

	security_file_free(file);

	ima_file_free(file);

	if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))

		cdev_put(inode->i_cdev);

	fops_put(file->f_op);

fs/inode.c

+17 −7
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
#include <linux/hash.h>

#include <linux/swap.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/pagemap.h>

#include <linux/cdev.h>

#include <linux/bootmem.h>
@@ -144,13 +145,13 @@ struct inode *inode_init_always(struct super_block *sb, struct inode *inode) 
	inode->i_cdev = NULL;

	inode->i_rdev = 0;

	inode->dirtied_when = 0;

	if (security_inode_alloc(inode)) {

		if (inode->i_sb->s_op->destroy_inode)

			inode->i_sb->s_op->destroy_inode(inode);

		else

			kmem_cache_free(inode_cachep, (inode));

		return NULL;

	}



	if (security_inode_alloc(inode))

		goto out_free_inode;



	/* allocate and initialize an i_integrity */

	if (ima_inode_alloc(inode))

		goto out_free_security;



	spin_lock_init(&inode->i_lock);

	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
@@ -186,6 +187,15 @@ struct inode *inode_init_always(struct super_block *sb, struct inode *inode) 
	inode->i_mapping = mapping;



	return inode;



out_free_security:

	security_inode_free(inode);

out_free_inode:

	if (inode->i_sb->s_op->destroy_inode)

		inode->i_sb->s_op->destroy_inode(inode);

	else

		kmem_cache_free(inode_cachep, (inode));

	return NULL;

}

EXPORT_SYMBOL(inode_init_always);

fs/namei.c

+8 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
#include <linux/fsnotify.h>

#include <linux/personality.h>

#include <linux/security.h>

#include <linux/ima.h>

#include <linux/syscalls.h>

#include <linux/mount.h>

#include <linux/audit.h>
@@ -860,6 +861,8 @@ static int __link_path_walk(const char *name, struct nameidata *nd) 
		err = exec_permission_lite(inode);

		if (err == -EAGAIN)

			err = vfs_permission(nd, MAY_EXEC);

		if (!err)

			err = ima_path_check(&nd->path, MAY_EXEC);

 		if (err)

			break;
@@ -1525,6 +1528,11 @@ int may_open(struct nameidata *nd, int acc_mode, int flag) 
	error = vfs_permission(nd, acc_mode);

	if (error)

		return error;



	error = ima_path_check(&nd->path,

			       acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC));

	if (error)

		return error;

	/*

	 * An append-only file must be opened in append mode for writing.

	 */