lkml.org 
[lkml]   [2020]   [Jun]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 03/12] ima: Free the entire rule when deleting a list of rules
    Date
    Use ima_free_rule() to fix memory leaks of allocated ima_rule_entry
    members, such as .fsname and .keyrings, when deleting a list of rules.

    This fixes a memory leak seen when loading by a valid rule that contains
    an additional piece of allocated memory, such as an fsname, followed by
    an invalid rule that triggers a policy load failure:

    # echo -e "dont_measure fsname=securityfs\nbad syntax" > \
    /sys/kernel/security/ima/policy
    -bash: echo: write error: Invalid argument
    # echo scan > /sys/kernel/debug/kmemleak
    # cat /sys/kernel/debug/kmemleak
    unreferenced object 0xffff9bab67ca12c0 (size 16):
    comm "tee", pid 684, jiffies 4295212803 (age 252.344s)
    hex dump (first 16 bytes):
    73 65 63 75 72 69 74 79 66 73 00 6b 6b 6b 6b a5 securityfs.kkkk.
    backtrace:
    [<00000000adc80b1b>] kstrdup+0x2e/0x60
    [<00000000d504cb0d>] ima_parse_add_rule+0x7d4/0x1020
    [<00000000444825ac>] ima_write_policy+0xab/0x1d0
    [<000000002b7f0d6c>] vfs_write+0xde/0x1d0
    [<0000000096feedcf>] ksys_write+0x68/0xe0
    [<0000000052b544a2>] do_syscall_64+0x56/0xa0
    [<000000007ead1ba7>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Fixes: f1b08bbcbdaf ("ima: define a new policy condition based on the filesystem name")
    Fixes: 2b60c0ecedf8 ("IMA: Read keyrings= option from the IMA policy")
    Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
    ---
    security/integrity/ima/ima_policy.c | 6 +-----
    1 file changed, 1 insertion(+), 5 deletions(-)

    diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
    index 1320333201c6..94ca3b8abb69 100644
    --- a/security/integrity/ima/ima_policy.c
    +++ b/security/integrity/ima/ima_policy.c
    @@ -1431,15 +1431,11 @@ ssize_t ima_parse_add_rule(char *rule)
    void ima_delete_rules(void)
    {
    struct ima_rule_entry *entry, *tmp;
    - int i;

    temp_ima_appraise = 0;
    list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
    - for (i = 0; i < MAX_LSM_RULES; i++)
    - kfree(entry->lsm[i].args_p);
    -
    list_del(&entry->list);
    - kfree(entry);
    + ima_free_rule(entry);
    }
    }

    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-23 02:35    [W:4.091 / U:0.340 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site