From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mimi Zohar Subject: Re: [PATCH v1 2/3] evm: skip integrity verification for newly created files Date: Tue, 15 Jul 2014 10:01:55 -0400 Message-ID: <1405432915.21720.22.camel@dhcp-9-2-203-236.watson.ibm.com> References: <5e9ede3ece0eb19bf5468826ea05aed5d8207cf1.1405078844.git.d.kasatkin@samsung.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org, dmitry.kasatkin@gmail.com To: Dmitry Kasatkin Return-path: In-Reply-To: <5e9ede3ece0eb19bf5468826ea05aed5d8207cf1.1405078844.git.d.kasatkin@samsung.com> Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Fri, 2014-07-11 at 14:47 +0300, Dmitry Kasatkin wrote: > Newly created files do not get initial security.ima until close. > Setting xattr value before close fails because EVM fails to verify > integrity due to missing xattrs. Following is the example when it > happens: > fd = open("foo", O_CREAT | O_WRONLY, 0644); > setxattr("foo", "security.SMACK64", value, sizeof(value), 0); > close(fd); > > This patch skips integrity verification if IMA_NEW_FILE flag is set. Right, unless the LSM initially created the security xattr at d_instantiate(), security.evm will not have been created. Mimi > > Signed-off-by: Dmitry Kasatkin > --- > security/integrity/evm/evm_main.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c > index 3bcb80d..682e640 100644 > --- a/security/integrity/evm/evm_main.c > +++ b/security/integrity/evm/evm_main.c > @@ -248,10 +248,14 @@ EXPORT_SYMBOL_GPL(evm_verifyxattr); > static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) > { > struct inode *inode = dentry->d_inode; > + struct integrity_iint_cache *iint; > > if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode) > return 0; > - return evm_verify_hmac(dentry, NULL, NULL, 0, NULL); > + iint = integrity_iint_find(inode); > + if (iint && (iint->flags & IMA_NEW_FILE)) > + return 0; > + return evm_verify_hmac(dentry, NULL, NULL, 0, iint); > } > > /*