ima: pass 'opened' flag to identify newly created files

Empty files and missing xattrs do not guarantee that a file was
just created.  This patch passes FILE_CREATED flag to IMA to
reliably identify new files.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org>  3.14+

diff --git a/fs/namei.c b/fs/namei.c
index 985c6f3684859e17439d62c7d319611305414437..005771f9718960b5e0764f4607095cf96dbd7829 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3058,7 +3058,7 @@ opened:
        error = open_check_o_direct(file);
        if (error)
                goto exit_fput;
-       error = ima_file_check(file, op->acc_mode);
+       error = ima_file_check(file, op->acc_mode, *opened);
        if (error)
                goto exit_fput;
 

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 140c496f612c4920c9a7819556f35841357e5aaa..d49c778faecb973e4cfbb3fdb560fb5345f5dd27 100644 (file)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -709,7 +709,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
                host_err = PTR_ERR(*filp);
                *filp = NULL;
        } else {
-               host_err = ima_file_check(*filp, may_flags);
+               host_err = ima_file_check(*filp, may_flags, 0);
 
                if (may_flags & NFSD_MAY_64BIT_COOKIE)
                        (*filp)->f_mode |= FMODE_64BITHASH;

diff --git a/include/linux/ima.h b/include/linux/ima.h
index 7cf5e9b3255013deb9b4feac058112f5d7acdc5a..120ccc53fcb7f85d80a3f1f0f94c2241e864fbb2 100644 (file)
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -15,7 +15,7 @@ struct linux_binprm;
 
 #ifdef CONFIG_IMA
 extern int ima_bprm_check(struct linux_binprm *bprm);
-extern int ima_file_check(struct file *file, int mask);
+extern int ima_file_check(struct file *file, int mask, int opened);
 extern void ima_file_free(struct file *file);
 extern int ima_file_mmap(struct file *file, unsigned long prot);
 extern int ima_module_check(struct file *file);
@@ -27,7 +27,7 @@ static inline int ima_bprm_check(struct linux_binprm *bprm)
        return 0;
 }
 
-static inline int ima_file_check(struct file *file, int mask)
+static inline int ima_file_check(struct file *file, int mask, int opened)
 {
        return 0;
 }

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 57da4bd7ba0c9cf0c465daaceeaaa77cdfe5f21d..0fb456c20eda8638627f2d2724539b5b09f9fd9f 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -177,7 +177,7 @@ void ima_delete_rules(void);
 int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
                             struct file *file, const unsigned char *filename,
                             struct evm_ima_xattr_data *xattr_value,
-                            int xattr_len);
+                            int xattr_len, int opened);
 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
@@ -193,7 +193,7 @@ static inline int ima_appraise_measurement(int func,
                                           struct file *file,
                                           const unsigned char *filename,
                                           struct evm_ima_xattr_data *xattr_value,
-                                          int xattr_len)
+                                          int xattr_len, int opened)
 {
        return INTEGRITY_UNKNOWN;
 }

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index a4605d67724858a7e7773e2fc196bd599625cf57..225fd944a4efbcad30a489af66f0eb47ba877823 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -183,7 +183,7 @@ int ima_read_xattr(struct dentry *dentry,
 int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
                             struct file *file, const unsigned char *filename,
                             struct evm_ima_xattr_data *xattr_value,
-                            int xattr_len)
+                            int xattr_len, int opened)
 {
        static const char op[] = "appraise_data";
        char *cause = "unknown";
@@ -203,7 +203,7 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
 
                cause = "missing-hash";
                status = INTEGRITY_NOLABEL;
-               if (inode->i_size == 0) {
+               if (opened & FILE_CREATED) {
                        iint->flags |= IMA_NEW_FILE;
                        status = INTEGRITY_PASS;
                }

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 0a2298f90c9c017bc1e240e026eb5c517aa50a43..f82cf9b8e92bebeab506aa6dd19906d297e64e4f 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -157,7 +157,7 @@ void ima_file_free(struct file *file)
 }
 
 static int process_measurement(struct file *file, const char *filename,
-                              int mask, int function)
+                              int mask, int function, int opened)
 {
        struct inode *inode = file_inode(file);
        struct integrity_iint_cache *iint;
@@ -226,7 +226,7 @@ static int process_measurement(struct file *file, const char *filename,
                                      xattr_value, xattr_len);
        if (action & IMA_APPRAISE_SUBMASK)
                rc = ima_appraise_measurement(_func, iint, file, pathname,
-                                             xattr_value, xattr_len);
+                                             xattr_value, xattr_len, opened);
        if (action & IMA_AUDIT)
                ima_audit_measurement(iint, pathname);
        kfree(pathbuf);
@@ -255,7 +255,7 @@ out:
 int ima_file_mmap(struct file *file, unsigned long prot)
 {
        if (file && (prot & PROT_EXEC))
-               return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK);
+               return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK, 0);
        return 0;
 }
 
@@ -277,7 +277,7 @@ int ima_bprm_check(struct linux_binprm *bprm)
        return process_measurement(bprm->file,
                                   (strcmp(bprm->filename, bprm->interp) == 0) ?
                                   bprm->filename : bprm->interp,
-                                  MAY_EXEC, BPRM_CHECK);
+                                  MAY_EXEC, BPRM_CHECK, 0);
 }
 
 /**
@@ -290,12 +290,12 @@ int ima_bprm_check(struct linux_binprm *bprm)
  * On success return 0.  On integrity appraisal error, assuming the file
  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
  */
-int ima_file_check(struct file *file, int mask)
+int ima_file_check(struct file *file, int mask, int opened)
 {
        ima_rdwr_violation_check(file);
        return process_measurement(file, NULL,
                                   mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
-                                  FILE_CHECK);
+                                  FILE_CHECK, opened);
 }
 EXPORT_SYMBOL_GPL(ima_file_check);
 
@@ -318,7 +318,7 @@ int ima_module_check(struct file *file)
 #endif
                return 0;       /* We rely on module signature checking */
        }
-       return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK);
+       return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK, 0);
 }
 
 int ima_fw_from_file(struct file *file, char *buf, size_t size)
@@ -329,7 +329,7 @@ int ima_fw_from_file(struct file *file, char *buf, size_t size)
                        return -EACCES; /* INTEGRITY_UNKNOWN */
                return 0;
        }
-       return process_measurement(file, NULL, MAY_EXEC, FIRMWARE_CHECK);
+       return process_measurement(file, NULL, MAY_EXEC, FIRMWARE_CHECK, 0);
 }
 
 static int __init init_ima(void)