lkml.org 
[lkml]   [2021]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[RFC 14/20] ima: Move some IMA policy and filesystem related variables into ima_namespace
    Date
    Move the ima_write_mutex, ima_fs_flag, and valid_policy variables into
    ima_namespace. This way each IMA namespace can set those variables
    independently.

    Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
    ---
    include/linux/ima.h | 5 ++++
    security/integrity/ima/ima_fs.c | 35 +++++++++++-------------
    security/integrity/ima/ima_init_ima_ns.c | 4 +++
    3 files changed, 25 insertions(+), 19 deletions(-)

    diff --git a/include/linux/ima.h b/include/linux/ima.h
    index 850a513834d2..fe08919df326 100644
    --- a/include/linux/ima.h
    +++ b/include/linux/ima.h
    @@ -262,6 +262,11 @@ struct ima_namespace {
    struct ima_h_table ima_htable;
    struct list_head ima_measurements;
    unsigned long binary_runtime_size;
    +
    + /* IMA's filesystem */
    + struct mutex ima_write_mutex;
    + unsigned long ima_fs_flags;
    + int valid_policy;
    };

    extern struct ima_namespace init_ima_ns;
    diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
    index c35e15fb313f..6c86f81c9998 100644
    --- a/security/integrity/ima/ima_fs.c
    +++ b/security/integrity/ima/ima_fs.c
    @@ -25,8 +25,6 @@

    #include "ima.h"

    -static DEFINE_MUTEX(ima_write_mutex);
    -
    bool ima_canonical_fmt;
    static int __init default_canonical_fmt_setup(char *str)
    {
    @@ -37,8 +35,6 @@ static int __init default_canonical_fmt_setup(char *str)
    }
    __setup("ima_canonical_fmt", default_canonical_fmt_setup);

    -static int valid_policy = 1;
    -
    static ssize_t ima_show_htable_value(char __user *buf, size_t count,
    loff_t *ppos, atomic_long_t *val)
    {
    @@ -320,6 +316,7 @@ static ssize_t ima_read_policy(char *path)
    static ssize_t ima_write_policy(struct file *file, const char __user *buf,
    size_t datalen, loff_t *ppos)
    {
    + struct ima_namespace *ns = get_current_ns();
    char *data;
    ssize_t result;

    @@ -337,7 +334,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
    goto out;
    }

    - result = mutex_lock_interruptible(&ima_write_mutex);
    + result = mutex_lock_interruptible(&ns->ima_write_mutex);
    if (result < 0)
    goto out_free;

    @@ -350,14 +347,14 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
    1, 0);
    result = -EACCES;
    } else {
    - result = ima_parse_add_rule(get_current_ns(), data);
    + result = ima_parse_add_rule(ns, data);
    }
    - mutex_unlock(&ima_write_mutex);
    + mutex_unlock(&ns->ima_write_mutex);
    out_free:
    kfree(data);
    out:
    if (result < 0)
    - valid_policy = 0;
    + ns->valid_policy = 0;

    return result;
    }
    @@ -374,8 +371,6 @@ enum ima_fs_flags {
    IMA_FS_BUSY,
    };

    -static unsigned long ima_fs_flags;
    -
    #ifdef CONFIG_IMA_READ_POLICY
    static const struct seq_operations ima_policy_seqops = {
    .start = ima_policy_start,
    @@ -390,6 +385,8 @@ static const struct seq_operations ima_policy_seqops = {
    */
    static int ima_open_policy(struct inode *inode, struct file *filp)
    {
    + struct ima_namespace *ns = get_current_ns();
    +
    if (!(filp->f_flags & O_WRONLY)) {
    #ifndef CONFIG_IMA_READ_POLICY
    return -EACCES;
    @@ -401,7 +398,7 @@ static int ima_open_policy(struct inode *inode, struct file *filp)
    return seq_open(filp, &ima_policy_seqops);
    #endif
    }
    - if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags))
    + if (test_and_set_bit(IMA_FS_BUSY, &ns->ima_fs_flags))
    return -EBUSY;
    return 0;
    }
    @@ -415,25 +412,25 @@ static int ima_open_policy(struct inode *inode, struct file *filp)
    */
    static int ima_release_policy(struct inode *inode, struct file *file)
    {
    - const char *cause = valid_policy ? "completed" : "failed";
    struct ima_namespace *ns = get_current_ns();
    + const char *cause = ns->valid_policy ? "completed" : "failed";

    if ((file->f_flags & O_ACCMODE) == O_RDONLY)
    return seq_release(inode, file);

    - if (valid_policy && ima_check_policy(ns) < 0) {
    + if (ns->valid_policy && ima_check_policy(ns) < 0) {
    cause = "failed";
    - valid_policy = 0;
    + ns->valid_policy = 0;
    }

    pr_info("policy update %s\n", cause);
    integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
    - "policy_update", cause, !valid_policy, 0);
    + "policy_update", cause, !ns->valid_policy, 0);

    - if (!valid_policy) {
    + if (!ns->valid_policy) {
    ima_delete_rules(ns);
    - valid_policy = 1;
    - clear_bit(IMA_FS_BUSY, &ima_fs_flags);
    + ns->valid_policy = 1;
    + clear_bit(IMA_FS_BUSY, &ns->ima_fs_flags);
    return 0;
    }

    @@ -442,7 +439,7 @@ static int ima_release_policy(struct inode *inode, struct file *file)
    securityfs_remove(ima_policy);
    ima_policy = NULL;
    #elif defined(CONFIG_IMA_WRITE_POLICY)
    - clear_bit(IMA_FS_BUSY, &ima_fs_flags);
    + clear_bit(IMA_FS_BUSY, &ns->ima_fs_flags);
    #elif defined(CONFIG_IMA_READ_POLICY)
    inode->i_mode &= ~S_IWUSR;
    #endif
    diff --git a/security/integrity/ima/ima_init_ima_ns.c b/security/integrity/ima/ima_init_ima_ns.c
    index 57e46a10c001..22ff74e85a5f 100644
    --- a/security/integrity/ima/ima_init_ima_ns.c
    +++ b/security/integrity/ima/ima_init_ima_ns.c
    @@ -49,6 +49,10 @@ int ima_init_namespace(struct ima_namespace *ns)
    else
    ns->binary_runtime_size = ULONG_MAX;

    + mutex_init(&ns->ima_write_mutex);
    + ns->valid_policy = 1;
    + ns->ima_fs_flags = 0;
    +
    return 0;
    }

    --
    2.31.1
    \
     
     \ /
      Last update: 2021-11-30 17:09    [W:4.226 / U:0.764 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site