Commit 9ddf6aa8 authored by James Morris's avatar James Morris
Browse files

Merge branch 'next-ima-appraisal' of... 

Merge branch 'next-ima-appraisal' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity into next

As requested by Mimi, this adds the IMA Appraisal feature.
parents b25b09ec 8606404f

Documentation/ABI/testing/ima_policy

+21 −4
Original line number Diff line number Diff line
@@ -12,11 +12,14 @@ Description: 
		then closing the file.  The new policy takes effect after

		the file ima/policy is closed.



		IMA appraisal, if configured, uses these file measurements

		for local measurement appraisal.



		rule format: action [condition ...]



		action: measure | dont_measure

		action: measure | dont_measure | appraise | dont_appraise

		condition:= base | lsm

			base:	[[func=] [mask=] [fsmagic=] [uid=]]

			base:	[[func=] [mask=] [fsmagic=] [uid=] [fowner]]

			lsm:	[[subj_user=] [subj_role=] [subj_type=]

				 [obj_user=] [obj_role=] [obj_type=]]
@@ -24,36 +27,50 @@ Description: 
			mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]

			fsmagic:= hex value

			uid:= decimal value

			fowner:=decimal value

		lsm:  	are LSM specific



		default policy:

			# PROC_SUPER_MAGIC

			dont_measure fsmagic=0x9fa0

			dont_appraise fsmagic=0x9fa0

			# SYSFS_MAGIC

			dont_measure fsmagic=0x62656572

			dont_appraise fsmagic=0x62656572

			# DEBUGFS_MAGIC

			dont_measure fsmagic=0x64626720

			dont_appraise fsmagic=0x64626720

			# TMPFS_MAGIC

			dont_measure fsmagic=0x01021994

			dont_appraise fsmagic=0x01021994

			# RAMFS_MAGIC

			dont_measure fsmagic=0x858458f6

			dont_appraise fsmagic=0x858458f6

			# SECURITYFS_MAGIC

			dont_measure fsmagic=0x73636673

			dont_appraise fsmagic=0x73636673



			measure func=BPRM_CHECK

			measure func=FILE_MMAP mask=MAY_EXEC

			measure func=FILE_CHECK mask=MAY_READ uid=0

			appraise fowner=0



		The default policy measures all executables in bprm_check,

		all files mmapped executable in file_mmap, and all files

		open for read by root in do_filp_open.

		open for read by root in do_filp_open.  The default appraisal

		policy appraises all files owned by root.



		Examples of LSM specific definitions:



		SELinux:

			# SELINUX_MAGIC

			dont_measure fsmagic=0xF97CFF8C

			dont_measure fsmagic=0xf97cff8c

			dont_appraise fsmagic=0xf97cff8c



			dont_measure obj_type=var_log_t

			dont_appraise obj_type=var_log_t

			dont_measure obj_type=auditd_log_t

			dont_appraise obj_type=auditd_log_t

			measure subj_user=system_u func=FILE_CHECK mask=MAY_READ

			measure subj_role=system_r func=FILE_CHECK mask=MAY_READ

Documentation/kernel-parameters.txt

+8 −0
Original line number Diff line number Diff line
@@ -1051,6 +1051,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted. 
	ihash_entries=	[KNL]

			Set number of hash buckets for inode cache.



	ima_appraise=	[IMA] appraise integrity measurements

			Format: { "off" | "enforce" | "fix" }

			default: "enforce"



	ima_appraise_tcb [IMA]

			The builtin appraise policy appraises all files

			owned by uid=0.



	ima_audit=	[IMA]

			Format: { "0" | "1" }

			0 -- integrity auditing messages. (Default)

fs/attr.c

+2 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <linux/fcntl.h>

#include <linux/security.h>

#include <linux/evm.h>

#include <linux/ima.h>



/**

 * inode_change_ok - check if attribute changes to an inode are allowed
@@ -247,6 +248,7 @@ int notify_change(struct dentry * dentry, struct iattr * attr) 


	if (!error) {

		fsnotify_change(dentry, ia_valid);

		ima_inode_post_setattr(dentry);

		evm_inode_post_setattr(dentry, ia_valid);

	}

fs/file_table.c

+1 −1
Original line number Diff line number Diff line
@@ -243,10 +243,10 @@ static void __fput(struct file *file) 
		if (file->f_op && file->f_op->fasync)

			file->f_op->fasync(-1, file, 0);

	}

	ima_file_free(file);

	if (file->f_op && file->f_op->release)

		file->f_op->release(inode, file);

	security_file_free(file);

	ima_file_free(file);

	if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL &&

		     !(file->f_mode & FMODE_PATH))) {

		cdev_put(inode->i_cdev);

fs/xattr.c

+4 −2
Original line number Diff line number Diff line
@@ -295,11 +295,13 @@ vfs_removexattr(struct dentry *dentry, const char *name) 
	if (error)

		return error;



	mutex_lock(&inode->i_mutex);

	error = security_inode_removexattr(dentry, name);

	if (error)

	if (error) {

		mutex_unlock(&inode->i_mutex);

		return error;

	}



	mutex_lock(&inode->i_mutex);

	error = inode->i_op->removexattr(dentry, name);

	mutex_unlock(&inode->i_mutex);