From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mimi Zohar Subject: [PATCH 15/15] ima: appraise measurement required Date: Thu, 24 Jun 2010 14:10:31 -0400 Message-ID: <1277403031-3080-16-git-send-email-zohar@linux.vnet.ibm.com> References: <1277403031-3080-1-git-send-email-zohar@linux.vnet.ibm.com> Cc: Mimi Zohar , linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, James Morris , David Safford , Dave Hansen , Mimi Zohar To: linux-kernel@vger.kernel.org Return-path: In-Reply-To: <1277403031-3080-1-git-send-email-zohar@linux.vnet.ibm.com> Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org Even if allowed to update security.ima, reset the appraisal flags, forcing re-appraisal. Signed-off-by: Mimi Zohar --- security/integrity/ima/ima_main.c | 33 +++++++++++++++++++++++++++++++-- 1 files changed, 31 insertions(+), 2 deletions(-) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 62a7cf6..44fd452 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -385,18 +385,47 @@ int ima_protect_xattr(struct dentry *dentry, const char *xattr_name, return 0; } +static void ima_reset_appraise_flags(struct inode *inode) +{ + struct integrity_iint_cache *iint; + + if (!ima_initialized || !ima_appraise || !S_ISREG(inode->i_mode)) + return; + + iint = integrity_iint_find_get(inode); + if (!iint) + return; + + mutex_lock(&iint->mutex); + iint->flags &= ~(IMA_COLLECTED | IMA_APPRAISED | IMA_MEASURED); + mutex_unlock(&iint->mutex); + kref_put(&iint->refcount, iint_free); + return; +} + int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, const void *xattr_value, size_t xattr_value_len) { - return ima_protect_xattr(dentry, xattr_name, xattr_value, + int result; + + result = ima_protect_xattr(dentry, xattr_name, xattr_value, xattr_value_len); + if (!result) + ima_reset_appraise_flags(dentry->d_inode); + return result; } int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name) { - return ima_protect_xattr(dentry, xattr_name, NULL, 0); + int result; + + result = ima_protect_xattr(dentry, xattr_name, NULL, 0); + if (!result) + ima_reset_appraise_flags(dentry->d_inode); + return result; } + static int __init init_ima(void) { int error; -- 1.6.6.1