[RFC PATCH 03/30] ima: Bind ima namespace to the file descriptor

krzysztof.struczynski
2020-08-18T15:26:25Z

From: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>

IMA namespace reference will be required in ima_file_free() to check
the policy and find inode integrity data for the correct ima namespace.
ima_file_free() is called on __fput(), and __fput() may be called after
releasing namespaces in exit_task_namespaces() in do_exit() and
therefore nsproxy reference cannot be used - it is already set to NULL.

This is a preparation for namespacing policy and inode integrity data.

Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
---
fs/file_table.c | 6 +++++-
include/linux/fs.h | 3 +++
include/linux/ima.h | 6 ++++++
security/integrity/ima/ima_main.c | 27 +++++++++++++++++++++++++--
4 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/fs/file_table.c b/fs/file_table.c
index 656647f9575a..878213d8af92 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -109,6 +109,8 @@ static struct file *__alloc_file(int flags, const struct cred *cred)
return ERR_PTR(error);
}

+ ima_file_alloc(f);
+
atomic_long_set(&f->f_count, 1);
rwlock_init(&f->f_owner.lock);
spin_lock_init(&f->f_lock);
@@ -259,8 +261,10 @@ static void __fput(struct file *file)
struct inode *inode = file->f_inode;
fmode_t mode = file->f_mode;

- if (unlikely(!(file->f_mode & FMODE_OPENED)))
+ if (unlikely(!(file->f_mode & FMODE_OPENED))) {
+ ima_file_free(file);
goto out;
+ }

might_sleep();

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 407881ebeab1..8d6264755935 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -947,6 +947,9 @@ struct file {
struct address_space *f_mapping;
errseq_t f_wb_err;
errseq_t f_sb_err; /* for syncfs */
+#ifdef CONFIG_IMA
+ void *f_ima;
+#endif
} __randomize_layout
__attribute__((aligned(4))); /* lest something weird decides that 2 is OK */

diff --git a/include/linux/ima.h b/include/linux/ima.h
index 5b6235b97603..3954cef57c00 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -21,6 +21,7 @@ struct llist_node;
extern int ima_bprm_check(struct linux_binprm *bprm);
extern int ima_file_check(struct file *file, int mask);
extern void ima_post_create_tmpfile(struct inode *inode);
+extern int ima_file_alloc(struct file *file);
extern void ima_file_free(struct file *file);
extern int ima_file_mmap(struct file *file, unsigned long prot);
extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot);
@@ -66,6 +67,11 @@ static inline void ima_post_create_tmpfile(struct inode *inode)
{
}

+static inline int ima_file_alloc(struct file *file)
+{
+ return 0;
+}
+
static inline void ima_file_free(struct file *file)
{
return;
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index d800e73c8b62..c7e29277b953 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -169,6 +169,23 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
mutex_unlock(&iint->mutex);
}

+/**
+ * ima_file_alloc - called on __alloc_file()
+ * @file: pointer to file structure being created
+ *
+ * Bind IMA namespace to the file descriptor. This is necessary, because
+ * __fput can be called after exit_task_namespaces() in do_exit().
+ * In that case nsproxy is already NULL and ima ns has to be found
+ * differently in ima_file_free(). If process joins different ima ns, files
+ * opened in the old ns will point to that (old) ns.
+ */
+int ima_file_alloc(struct file *file)
+{
+ file->f_ima = get_current_ns();
+ get_ima_ns((struct ima_namespace *)file->f_ima);
+ return 0;
+}
+
/**
* ima_file_free - called on __fput()
* @file: pointer to file structure being freed
@@ -179,15 +196,21 @@ void ima_file_free(struct file *file)
{
struct inode *inode = file_inode(file);
struct integrity_iint_cache *iint;
+ struct ima_namespace *ima_ns = (struct ima_namespace *)file->f_ima;
+
+ if (unlikely(!(file->f_mode & FMODE_OPENED)))
+ goto out;

if (!ima_policy_flag || !S_ISREG(inode->i_mode))
- return;
+ goto out;

iint = integrity_iint_find(inode);
if (!iint)
- return;
+ goto out;

ima_check_last_writer(iint, inode, file);
+out:
+ put_ima_ns(ima_ns);
}

static int process_measurement(struct file *file, const struct cred *cred,
--
2.20.1