lkml.org 
[lkml]   [2021]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2 5/6] evm: Align evm_inode_init_security() definition with LSM infrastructure
    Date
    This patch changes the evm_inode_init_security() definition to align with
    the LSM infrastructure, in preparation for moving IMA and EVM to that
    infrastructure.

    Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    ---
    include/linux/evm.h | 17 ++++++++++-------
    security/integrity/evm/evm_main.c | 17 +++++++++++------
    security/security.c | 7 +++----
    3 files changed, 24 insertions(+), 17 deletions(-)

    diff --git a/include/linux/evm.h b/include/linux/evm.h
    index 8cad46bcec9d..b6c4092426f3 100644
    --- a/include/linux/evm.h
    +++ b/include/linux/evm.h
    @@ -34,9 +34,9 @@ extern int evm_inode_removexattr(struct user_namespace *mnt_userns,
    struct dentry *dentry, const char *xattr_name);
    extern void evm_inode_post_removexattr(struct dentry *dentry,
    const char *xattr_name);
    -extern int evm_inode_init_security(struct inode *inode,
    - const struct xattr *xattr_array,
    - struct xattr *evm);
    +extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
    + const struct qstr *qstr,
    + struct xattr *xattrs, void *fs_data);
    extern bool evm_status_revalidate(const char *xattr_name);
    #ifdef CONFIG_FS_POSIX_ACL
    extern int posix_xattr_acl(const char *xattrname);
    @@ -102,11 +102,14 @@ static inline void evm_inode_post_removexattr(struct dentry *dentry,
    return;
    }

    -static inline int evm_inode_init_security(struct inode *inode,
    - const struct xattr *xattr_array,
    - struct xattr *evm)
    +static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
    + const struct qstr *qstr,
    + struct xattr *xattrs, void *fs_data)
    {
    - return 0;
    + if (!xattrs || !xattrs->name)
    + return 0;
    +
    + return -EOPNOTSUPP;
    }

    static inline bool evm_status_revalidate(const char *xattr_name)
    diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
    index 84a9b7a69b1f..336a421e2e5a 100644
    --- a/security/integrity/evm/evm_main.c
    +++ b/security/integrity/evm/evm_main.c
    @@ -17,6 +17,7 @@
    #include <linux/xattr.h>
    #include <linux/integrity.h>
    #include <linux/evm.h>
    +#include <linux/lsm_hooks.h>
    #include <linux/magic.h>
    #include <linux/posix_acl_xattr.h>

    @@ -706,23 +707,27 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
    /*
    * evm_inode_init_security - initializes security.evm HMAC value
    */
    -int evm_inode_init_security(struct inode *inode,
    - const struct xattr *lsm_xattr,
    - struct xattr *evm_xattr)
    +int evm_inode_init_security(struct inode *inode, struct inode *dir,
    + const struct qstr *qstr,
    + struct xattr *xattrs, void *fs_data)
    {
    struct evm_xattr *xattr_data;
    + struct xattr *evm_xattr = lsm_find_xattr_slot(xattrs);
    int rc;

    - if (!(evm_initialized & EVM_INIT_HMAC) ||
    - !evm_protected_xattr(lsm_xattr->name))
    + if (!xattrs || !xattrs->name)
    return 0;

    + if (!(evm_initialized & EVM_INIT_HMAC) ||
    + !evm_protected_xattr(xattrs->name))
    + return -EOPNOTSUPP;
    +
    xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
    if (!xattr_data)
    return -ENOMEM;

    xattr_data->data.type = EVM_XATTR_HMAC;
    - rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
    + rc = evm_init_hmac(inode, xattrs, xattr_data->digest);
    if (rc < 0)
    goto out;

    diff --git a/security/security.c b/security/security.c
    index 2ab67fa4422e..ee5b9caccc40 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -1027,7 +1027,7 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
    const initxattrs initxattrs, void *fs_data)
    {
    struct xattr *new_xattrs;
    - struct xattr *lsm_xattr, *evm_xattr, *xattr;
    + struct xattr *lsm_xattr, *xattr;
    struct security_hook_list *P;
    int ret, max_new_xattrs = 0;

    @@ -1082,9 +1082,8 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
    goto out;
    }

    - evm_xattr = lsm_xattr;
    - ret = evm_inode_init_security(inode, new_xattrs, evm_xattr);
    - if (ret)
    + ret = evm_inode_init_security(inode, dir, qstr, new_xattrs, fs_data);
    + if (ret && ret != -EOPNOTSUPP)
    goto out;
    ret = initxattrs(inode, new_xattrs, fs_data);
    out:
    --
    2.25.1
    \
     
     \ /
      Last update: 2021-04-21 18:22    [W:4.372 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site