Merge branch 'bugfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
* 'bugfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: integrity: add ima_counts_put (updated) integrity: ima audit hash_exists fix integrity: ima mq_open imbalance msg fix
This commit is contained in:
Коммит
bb1e9b844b
|
@ -1761,6 +1761,10 @@ do_last:
|
|||
goto exit;
|
||||
}
|
||||
filp = nameidata_to_filp(&nd, open_flag);
|
||||
if (IS_ERR(filp))
|
||||
ima_counts_put(&nd.path,
|
||||
acc_mode & (MAY_READ | MAY_WRITE |
|
||||
MAY_EXEC));
|
||||
mnt_drop_write(nd.path.mnt);
|
||||
if (nd.root.mnt)
|
||||
path_put(&nd.root);
|
||||
|
@ -1817,6 +1821,9 @@ ok:
|
|||
goto exit;
|
||||
}
|
||||
filp = nameidata_to_filp(&nd, open_flag);
|
||||
if (IS_ERR(filp))
|
||||
ima_counts_put(&nd.path,
|
||||
acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC));
|
||||
/*
|
||||
* It is now safe to drop the mnt write
|
||||
* because the filp has had a write taken
|
||||
|
|
|
@ -24,6 +24,7 @@ extern int ima_path_check(struct path *path, int mask, int update_counts);
|
|||
extern void ima_file_free(struct file *file);
|
||||
extern int ima_file_mmap(struct file *file, unsigned long prot);
|
||||
extern void ima_counts_get(struct file *file);
|
||||
extern void ima_counts_put(struct path *path, int mask);
|
||||
|
||||
#else
|
||||
static inline int ima_bprm_check(struct linux_binprm *bprm)
|
||||
|
@ -60,5 +61,10 @@ static inline void ima_counts_get(struct file *file)
|
|||
{
|
||||
return;
|
||||
}
|
||||
|
||||
static inline void ima_counts_put(struct path *path, int mask)
|
||||
{
|
||||
return;
|
||||
}
|
||||
#endif /* CONFIG_IMA_H */
|
||||
#endif /* _LINUX_IMA_H */
|
||||
|
|
|
@ -32,6 +32,7 @@
|
|||
#include <linux/nsproxy.h>
|
||||
#include <linux/pid.h>
|
||||
#include <linux/ipc_namespace.h>
|
||||
#include <linux/ima.h>
|
||||
|
||||
#include <net/sock.h>
|
||||
#include "util.h"
|
||||
|
@ -733,6 +734,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
|
|||
error = PTR_ERR(filp);
|
||||
goto out_putfd;
|
||||
}
|
||||
ima_counts_get(filp);
|
||||
|
||||
fd_install(fd, filp);
|
||||
goto out_upsem;
|
||||
|
|
|
@ -238,7 +238,34 @@ out:
|
|||
}
|
||||
|
||||
/*
|
||||
* ima_opens_get - increment file counts
|
||||
* ima_counts_put - decrement file counts
|
||||
*
|
||||
* File counts are incremented in ima_path_check. On file open
|
||||
* error, such as ETXTBSY, decrement the counts to prevent
|
||||
* unnecessary imbalance messages.
|
||||
*/
|
||||
void ima_counts_put(struct path *path, int mask)
|
||||
{
|
||||
struct inode *inode = path->dentry->d_inode;
|
||||
struct ima_iint_cache *iint;
|
||||
|
||||
if (!ima_initialized || !S_ISREG(inode->i_mode))
|
||||
return;
|
||||
iint = ima_iint_find_insert_get(inode);
|
||||
if (!iint)
|
||||
return;
|
||||
|
||||
mutex_lock(&iint->mutex);
|
||||
iint->opencount--;
|
||||
if ((mask & MAY_WRITE) || (mask == 0))
|
||||
iint->writecount--;
|
||||
else if (mask & (MAY_READ | MAY_EXEC))
|
||||
iint->readcount--;
|
||||
mutex_unlock(&iint->mutex);
|
||||
}
|
||||
|
||||
/*
|
||||
* ima_counts_get - increment file counts
|
||||
*
|
||||
* - for IPC shm and shmat file.
|
||||
* - for nfsd exported files.
|
||||
|
|
|
@ -134,7 +134,8 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
|
|||
}
|
||||
out:
|
||||
mutex_unlock(&ima_extend_list_mutex);
|
||||
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, entry->template_name,
|
||||
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
|
||||
entry->template.file_name,
|
||||
op, audit_cause, result, audit_info);
|
||||
return result;
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче