Re: [PATCH v1 1/3] ima: provide flag to identify new empty files

[Mimi Zohar <zohar@linux.vnet.ibm.com>]

On Fri, 2014-07-11 at 14:46 +0300, Dmitry Kasatkin wrote: 
> Newly created empty files do not get initial security.ima
> value because iversion does not change. It can be checked from
> the shell as:
> 
>   $ (exec >foo)
>   $ getfattr -h -e hex -d -m security foo
> 
> This patch defines IMA_NEW_FILE flag which is set when IMA detects that new
> file is created. It is checked upon ima_file_free hook to set initial
> security.ima value.

Other than rebasing on top of #next, this patch set looks good.

thanks,

Mimi

> Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>

> ---
>  security/integrity/ima/ima_appraise.c |  7 +++++--
>  security/integrity/ima/ima_main.c     | 12 +++++++-----
>  security/integrity/integrity.h        |  1 +
>  3 files changed, 13 insertions(+), 7 deletions(-)
> 
> diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
> index 9dd18b5..3a4beb3 100644
> --- a/security/integrity/ima/ima_appraise.c
> +++ b/security/integrity/ima/ima_appraise.c
> @@ -194,8 +194,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
>  			goto out;
> 
>  		cause = "missing-hash";
> -		status =
> -		    (inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL;
> +		status = INTEGRITY_NOLABEL;
> +		if (inode->i_size == 0) {
> +			iint->flags |= IMA_NEW_FILE;
> +			status = INTEGRITY_PASS;
> +		}
>  		goto out;
>  	}
> 
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index e51e0d5..5a870e7 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -124,11 +124,13 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
>  		return;
> 
>  	mutex_lock(&iint->mutex);
> -	if (atomic_read(&inode->i_writecount) == 1 &&
> -	    iint->version != inode->i_version) {
> -		iint->flags &= ~IMA_DONE_MASK;
> -		if (iint->flags & IMA_APPRAISE)
> -			ima_update_xattr(iint, file);
> +	if (atomic_read(&inode->i_writecount) == 1) {
> +		if ((iint->version != inode->i_version) ||
> +		    (iint->flags & IMA_NEW_FILE)) {
> +			iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
> +			if (iint->flags & IMA_APPRAISE)
> +				ima_update_xattr(iint, file);
> +		}
>  	}
>  	mutex_unlock(&iint->mutex);
>  }
> diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
> index 92c1083..7656d47 100644
> --- a/security/integrity/integrity.h
> +++ b/security/integrity/integrity.h
> @@ -30,6 +30,7 @@
>  #define IMA_ACTION_FLAGS	0xff000000
>  #define IMA_DIGSIG_REQUIRED	0x01000000
>  #define IMA_PERMIT_DIRECTIO	0x02000000
> +#define IMA_NEW_FILE		0x04000000
> 
>  #define IMA_DO_MASK		(IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
>  				 IMA_APPRAISE_SUBMASK)