Commit 6f6723e2 authored Apr 24, 2017 by Mimi Zohar

ima: define is_ima_appraise_enabled()



Only return enabled if in enforcing mode, not fix or log modes.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

Changes:
- Define is_ima_appraise_enabled() as a bool (Thiago Bauermann)

parent e1f5e01f

include/linux/ima.h

+6 −0

Original line number	Diff line number	Diff line
		@@ -75,11 +75,17 @@ static inline void ima_add_kexec_buffer(struct kimage *image)
		#endif

		#ifdef CONFIG_IMA_APPRAISE
		extern bool is_ima_appraise_enabled(void);
		extern void ima_inode_post_setattr(struct dentry *dentry);
		extern int ima_inode_setxattr(struct dentry dentry, const char xattr_name,
		const void *xattr_value, size_t xattr_value_len);
		extern int ima_inode_removexattr(struct dentry dentry, const char xattr_name);
		#else
		static inline bool is_ima_appraise_enabled(void)
		{
		return 0;
		}

		static inline void ima_inode_post_setattr(struct dentry *dentry)
		{
		return;

security/integrity/ima/ima_appraise.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -33,6 +33,16 @@ static int __init default_appraise_setup(char *str)

		__setup("ima_appraise=", default_appraise_setup);

		/*
		* is_ima_appraise_enabled - return appraise status
		*
		* Only return enabled, if not in ima_appraise="fix" or "log" modes.
		*/
		bool is_ima_appraise_enabled(void)
		{
		return (ima_appraise & IMA_APPRAISE_ENFORCE) ? 1 : 0;
		}

		/*
		* ima_must_appraise - set appraise flag
		*