Messages in this thread Patch in this message | | | From | Dmitry Kasatkin <> | Subject | [PATCH 13/20] ima: replace opencount with bitop | Date | Wed, 23 Apr 2014 16:30:31 +0300 |
| |
Current implementation uses opencount to allow only single writer to update policy at a time. After policy update 'ima/policy' sysfs entry is removed which disallow future updates.
Following patches might introduce posibility to update policy multiple times. Current open count implementation will not be valid.
This patch replaces usage of opencount with busy bit.
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> --- security/integrity/ima/ima_fs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index da92fcc..71f0d8f 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -288,7 +288,12 @@ static struct dentry *runtime_measurements_count; static struct dentry *violations; static struct dentry *ima_policy; -static atomic_t policy_opencount = ATOMIC_INIT(1); +enum ima_fs_flags { + IMA_FS_BUSY = 0, +}; + +static unsigned long ima_fs_flags; + /* * ima_open_policy: sequentialize access to the policy file */ @@ -297,9 +302,9 @@ static int ima_open_policy(struct inode *inode, struct file *filp) /* No point in being allowed to open it if you aren't going to write */ if (!(filp->f_flags & O_WRONLY)) return -EACCES; - if (atomic_dec_and_test(&policy_opencount)) - return 0; - return -EBUSY; + if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags)) + return -EBUSY; + return 0; } /* @@ -314,12 +319,12 @@ static int ima_release_policy(struct inode *inode, struct file *file) if (!valid_policy) { ima_delete_rules(); valid_policy = 1; - atomic_set(&policy_opencount, 1); - return 0; + } else { + ima_update_policy(); + securityfs_remove(ima_policy); + ima_policy = NULL; } - ima_update_policy(); - securityfs_remove(ima_policy); - ima_policy = NULL; + clear_bit(IMA_FS_BUSY, &ima_fs_flags); return 0; } -- 1.8.3.2
| |