lkml.org 
[lkml]   [2014]   [Jul]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v1 2/3] evm: skip integrity verification for newly created files
Date
Newly created files do not get initial security.ima until close.
Setting xattr value before close fails because EVM fails to verify
integrity due to missing xattrs. Following is the example when it
happens:
fd = open("foo", O_CREAT | O_WRONLY, 0644);
setxattr("foo", "security.SMACK64", value, sizeof(value), 0);
close(fd);

This patch skips integrity verification if IMA_NEW_FILE flag is set.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
---
security/integrity/evm/evm_main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 3bcb80d..682e640 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -248,10 +248,14 @@ EXPORT_SYMBOL_GPL(evm_verifyxattr);
static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
+ struct integrity_iint_cache *iint;

if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode)
return 0;
- return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
+ iint = integrity_iint_find(inode);
+ if (iint && (iint->flags & IMA_NEW_FILE))
+ return 0;
+ return evm_verify_hmac(dentry, NULL, NULL, 0, iint);
}

/*
--
1.9.1


\
 
 \ /
  Last update: 2014-07-11 14:41    [W:0.076 / U:1.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site