[PATCH 1/3] evm: added flag IMA_NEW in the integrity_iint_cache structure

[PATCH 1/3] evm: added flag IMA_NEW in the integrity_iint_cache structure

[Roberto Sassu]

[-- Attachment #1: Type: text/plain, Size: 3823 bytes --]

The flag IMA_NEW is set in the function evm_inode_post_init_security()
to distinguish between new and existent files and it is cleared in the
function ima_dec_counts(). This permits to check/fix the 'security.ima'
extended attribute properly in the function ima_appraise_measurement()
without verifying the 'version' field of the 'integrity_iint_cache'
structure.
The 'i_version' field of the inode is not suitable for determining if a
file is being created because the value '1' may be assumed by inodes
already in the filesystem before mounting the same with the parameter
'iversion' as well as those newly created.

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
---
 security/integrity/evm/evm_main.c     |   23 ++++++++++++++++++++---
 security/integrity/ima/ima_appraise.c |    2 +-
 security/integrity/ima/ima_main.c     |    2 +-
 security/integrity/integrity.h        |    1 +
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index cca6410..db5e66f 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -274,14 +274,25 @@ int evm_inode_post_init_security(struct inode *inode, const struct xattr *lsm_xa
 {
 	u8 *hmac_val;
 	int rc;
+	struct integrity_iint_cache *iint;
 
 	if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name))
 		return -EOPNOTSUPP;
 
-	hmac_val = kzalloc(MAX_DIGEST_SIZE, GFP_NOFS);
-	if (!hmac_val)
+	iint = integrity_iint_find_get(inode);
+	if (!iint)
 		return -ENOMEM;
 
+	mutex_lock(&iint->mutex);
+	iint->flags |= IMA_NEW;
+	mutex_unlock(&iint->mutex);
+
+	hmac_val = kzalloc(MAX_DIGEST_SIZE, GFP_NOFS);
+	if (!hmac_val) {
+		rc = -ENOMEM;
+		goto outnofree;
+	}
+
 	rc = evm_init_hmac(inode, lsm_xattr, hmac_val);
 	if (rc < 0)
 		goto out;
@@ -289,9 +300,15 @@ int evm_inode_post_init_security(struct inode *inode, const struct xattr *lsm_xa
 	evm_xattr->value = hmac_val;
 	evm_xattr->value_len = evm_hmac_size;
 	evm_xattr->name = XATTR_EVM_SUFFIX;
-	return 0;
+	goto outrelease;
 out:
 	kfree(hmac_val);
+outnofree:
+	mutex_lock(&iint->mutex);
+	iint->flags &= ~IMA_NEW;
+	mutex_unlock(&iint->mutex);
+outrelease:
+	kref_put(&iint->refcount, iint_free);
 	return rc;
 }
 EXPORT_SYMBOL_GPL(evm_inode_post_init_security);
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index fb402fa..b0256e6 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -114,7 +114,7 @@ int ima_appraise_measurement(struct integrity_iint_cache *iint,
 	return status;
 err_out:
 	if (rc == -ENODATA) {
-		if (iint->version == 1)
+		if (iint->flags & IMA_NEW)
 			return 0;
 		cause = "missing-hash";
 		if (ima_appraise & IMA_APPRAISE_FIX)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 14c39a5..cd29bf2 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -197,7 +197,7 @@ static void ima_dec_counts(struct integrity_iint_cache *iint,
 		if (iint->writecount == 0) {
 			if (iint->version != inode->i_version) {
 				iint->flags &= ~(IMA_COLLECTED | IMA_APPRAISED
-						 | IMA_MEASURED);
+						 | IMA_MEASURED | IMA_NEW);
 				if (iint->flags & IMA_APPRAISE)
 					ima_update_xattr(iint, file);
 			}
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 3a9b3de..a25b019 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -23,6 +23,7 @@
 #define IMA_APPRAISE		4
 #define IMA_APPRAISED		8
 #define IMA_COLLECTED		16
+#define IMA_NEW			32
 
 /* integrity data associated with an inode */
 struct integrity_iint_cache {
-- 
1.7.2.3


[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 4707 bytes --]

Re: [PATCH 1/3] evm: added flag IMA_NEW in the integrity_iint_cache structure

[Mimi Zohar]

On Tue, 2010-11-02 at 11:05 +0100, Roberto Sassu wrote:
> The flag IMA_NEW is set in the function evm_inode_post_init_security()
> to distinguish between new and existent files and it is cleared in the
> function ima_dec_counts(). This permits to check/fix the 'security.ima'
> extended attribute properly in the function ima_appraise_measurement()
> without verifying the 'version' field of the 'integrity_iint_cache'
> structure.
> The 'i_version' field of the inode is not suitable for determining if a
> file is being created because the value '1' may be assumed by inodes
> already in the filesystem before mounting the same with the parameter
> 'iversion' as well as those newly created.
> 
> Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>

Hi Roberto.  Yes, the current patches are not differentiating an
existing file from a new one properly. I think it can be done by
replacing the 'inode->iversion == 1' test in ima_appraise_measurement()
with a test for 'inode->i_size == 0', without adding an xattr.
.
thanks,

Mimi