From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mimi Zohar Subject: [RFC][PATCH v1 6/9] ima: add inode_post_setattr call Date: Mon, 30 Jan 2012 17:14:01 -0500 Message-ID: <1327961644-6886-7-git-send-email-zohar@linux.vnet.ibm.com> References: <1327961644-6886-1-git-send-email-zohar@linux.vnet.ibm.com> Cc: Mimi Zohar , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, David Safford , Dmitry Kasatkin , Mimi Zohar To: linux-security-module@vger.kernel.org Return-path: In-Reply-To: <1327961644-6886-1-git-send-email-zohar@linux.vnet.ibm.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org Changing an inode's metadata may result in our not needing to appraise the file. In such cases, we must remove 'security.ima'. Changelog v1: - use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured Signed-off-by: Mimi Zohar Acked-by: Serge Hallyn --- fs/attr.c | 2 ++ include/linux/ima.h | 10 ++++++++++ 2 files changed, 12 insertions(+), 0 deletions(-) diff --git a/fs/attr.c b/fs/attr.c index d9bd7fc..f496bac 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -14,6 +14,7 @@ #include #include #include +#include /** * inode_change_ok - check if attribute changes to an inode are allowed @@ -245,6 +246,7 @@ int notify_change(struct dentry * dentry, struct iattr * attr) if (!error) { fsnotify_change(dentry, ia_valid); + ima_inode_post_setattr(dentry); evm_inode_post_setattr(dentry, ia_valid); } diff --git a/include/linux/ima.h b/include/linux/ima.h index 6ac8e50..e2bfbb1 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -39,5 +39,15 @@ static inline int ima_file_mmap(struct file *file, unsigned long prot) { return 0; } + #endif /* CONFIG_IMA_H */ + +#ifdef CONFIG_IMA_APPRAISE +extern void ima_inode_post_setattr(struct dentry *dentry); +#else +static inline void ima_inode_post_setattr(struct dentry *dentry) +{ + return; +} +#endif /* CONFIG_IMA_APPRAISE_H */ #endif /* _LINUX_IMA_H */ -- 1.7.6.5